The vulnerability was mitigated by removing the specific code that allowed an application to read protected user data, indicating that before the fix an attacker’s application could potentially read sensitive information. The weakness falls under Incorrect Access Control (CWE‑284), which can lead to unauthorized disclosure of data owned by the user or the system. The description does not detail the sensor it acts on, however the fix statement implies that the code path was dangerous enough to warrant removal entirely.

Apple’s macOS operating system is affected, specifically versions released before macOS Sequoia 15.6 and before macOS Sonoma 14.7.7. Users running earlier releases of these macOS branches are vulnerable until they apply the update that contains the removal of the problematic code.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS score of less than 1% indicates that, at present, the probability of exploitation in the wild is very low, and the vulnerability is not reported as a known exploited vulnerability in the CISA KEV catalog. The likely attack vector is local, where a malicious or compromised application runs with user privileges and exploits the flawed access control to read protected data. No remote exploitation vector is indicated in the available information.