This vulnerability in Apple macOS arises from improper state management, allowing an application to read sensitive user data that should otherwise be protected. The weakness is classified as an information exposure flaw, meaning the attacker can gain unauthorized access to confidential data. The CVSS score of 5.5 indicates a moderate level of severity, reflecting that while the vulnerability is not catastrophic, it still permits a privacy compromise if exploited.

All Apple macOS installations prior to version 26.1 are impacted. The official fix is delivered in macOS Tahoe 26.1, which addresses the state management flaw. No specific product sub‑versions are listed beyond the overall macOS family.

The EPSS score of < 1% shows a very low likelihood of observed exploitation, and the vulnerability is currently not present in the CISA KEV catalogue. The likely attack vector involves a local or semi‑trusted application that can obtain the requisite privileges to read sensitive data, as no network‑based exploitation is described. Given the moderate CVSS score and the minimal exploitation probability, the risk to an organization is moderate, but the confidentiality impact could be significant if sensitive data were accessed.