Logging calls in the operating system were able to record raw, sensitive user data without proper redaction, which could allow an application to read that information and expose it to the wrong audience. The flaw is characterized as an improper data handling weakness (CWE‑532) and can lead to the disclosure of data that the user intended to keep private. The patch addresses the issue by adding stricter redaction of logged content before it is written to persistent storage.

The vulnerability affects Apple devices running iOS, iPadOS, macOS (Tahoe), tvOS, visionOS, and watchOS. Apple has fixed the issue in version 26 of each operating system, so devices running older releases are potentially vulnerable.

The CVSS score of 5.5 indicates a medium‑severity impact. The EPSS score of less than 1% reflects a very low probability of real‑world exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to install or run a malicious application on the device to read logs containing sensitive data. No public exploitation has been reported, so the immediate threat level is low but an OS update is recommended to eliminate the potential data exposure.