The vulnerability is a correctness issue that was corrected by adding improved checks in Apple systems. The flaw allows an application to read sensitive user data that it should not have access to, making it an information disclosure problem described by CWE‑200. An app that runs under higher privileges or operates as a malicious third‑party can exploit this weakness to obtain protected data from a device, which can compromise user privacy.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw is present in any version before iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7 and Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26.

The CVSS score of 5.5 indicates moderate severity while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to install a malicious or over‑privileged application on the device to read protected data, making the threat primarily local and contingent on the app ecosystem. Based on the description, it is inferred that the vulnerability is triggered by improper data access checks within app code.