A flaw in the locked‑screen behaviour of macOS allows an attacker who has physical access to read the device’s contacts from the lock screen. The weakness is an authentication and access control issue, identified as CWE‑284, resulting in the undisclosed personal data of users being exposed without their consent. The vulnerability does not grant higher privileges or remote code execution but compromises confidentiality of contact information.

Apple’s macOS operating system is affected. Versions prior to macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and macOS Tahoe 26.1 contain the flaw; the specified releases contain the fix. All earlier releases of these macOS lines should be considered vulnerable.

The CVSS score is 2.4, indicating low severity. The EPSS score is less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog, implying a low likelihood of exploitation. Because the attack vector is physical access, attackers need proximity to the device, limiting the threat surface. Although the data disclosure could be sensitive to the victim, the overall risk to systems or broader organizational infrastructure remains low.