This vulnerability arises from improper cache handling in the hot‑corner feature of macOS. When the user activates a hot corner, the system may inadvertently expose the contents of notes that have been deleted. The result is the privacy breach of potentially sensitive personal information, as documented by CWE‑200.

Apple macOS, particularly the Sequoia series. All releases before macOS Sequoia 15.5 are vulnerable; the issue was fixed in macOS Sequoia 15.5. Users running any earlier 15.x version should upgrade.

The CVSS score is 5.5, indicating a moderate risk. The EPSS score is less than 1% and the vulnerability is not included in CISA’s KEV catalog, implying a low exploitation probability in the current landscape. Nevertheless, an attacker could exploit the feature locally by initiating a hot‑corner action—potentially through user interaction, remote control of a logged‑in session, or automated UI scripts—to view deleted notes. The attack vector is likely local but could be leveraged in environments with shared or unattended devices.