A vulnerability in Apple operating systems allowed an application to access sensitive user data by not adequately controlling access to that data. This flaw, identified as an information exposure weakness (CWE‑359), was fixed by removing the vulnerable code from the system. If not patched, a malicious or poorly built app could read private information, compromising user privacy.

Apple iOS (versions 18.7.2 and 26.1), iPadOS (18.7.2 and 26.1), macOS Sequoia (15.7.2), macOS Sonoma (14.8.2), macOS Tahoe (26.1) and visionOS (26.1) are affected. These versions previously contained the vulnerable component that could be exploited before the update resolved the issue.

The CVSS score of 5.5 indicates a moderate impact, but the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability can be leveraged by installing a malicious or compromised application on the device; no remote exploitation vector is documented. The issue is not listed in CISA’s KEV catalog, further lowering the perceived risk. Nonetheless, any app that gains permission to read sensitive data could expose personal information if the device remains unpatched.