This issue was caused by inadequate redaction of sensitive information, which can allow an application to collect device‑specific identifiers or other metadata that may be used to fingerprint a user. The vulnerability aligns with CWE‑359, indicating that sensitive data was exposed due to improper handling. The description does not mention any ability to execute code or disrupt services, so the primary consequence is the loss of user privacy rather than a direct attack on system integrity or availability.

Affected product families are Apple iOS, iPadOS and macOS. The fix is reported in iOS 26, iPadOS 26 and macOS Tahoe 26, implying that all releases older than those versions are vulnerable. No product‑specific version list is provided, so all builds preceding the listed releases are considered at risk.

The CVSS score of 5.5 signals moderate impact, while an EPSS score below 1 % indicates a very low probability of exploitation at this time. The vulnerability is not catalogued as a known exploited vulnerability by CISA. Based on the description, the attack vector appears to be local, requiring an installed application with access to improperly redacted logs or system data; there is no indication of remote exploitation capabilities or privilege escalation.