The vulnerability is a logging flaw that failed to redact sensitive user data, allowing a compromised or poorly designed application to read log files and glean private information. It constitutes a log file confidentiality leak (CWE‑532). The impact is the disclosure of potentially sensitive personal information, which could be used for further attacks or identity theft, but does not directly allow remote code execution or denial of service. Based on the description, the attack vector is an application with local read access to system logs; no network exposure is implied.

The flaw affects Apple’s operating systems: iOS, iPadOS, macOS, tvOS, visionOS, and watchOS on all releases before 26. The issue was fixed in iOS 26, iPadOS 26, macOS 26 (Tahoe 26), tvOS 26, visionOS 26, and watchOS 26.

The CVSS score of 5.5 indicates a medium severity vulnerability, and the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The flaw is not listed in the CISA KEV catalog. Exploitation requires that an application gains read access to system log files that contain unredacted sensitive data; once read, the attacker can view personal information. The typical scenario involves a malicious app in the App Store or a locally installed application that has sufficient privileges, but the requirement for local file access limits widespread remote exploitation.