An entitlement check flaw in Apple iOS, iPadOS, and macOS allows an application to access sensitive user data without proper authorization. The missing entitlement checks create an access control weakness (CWE‑284). An attacker who can install or trick the user into installing a malicious app could read protected information, potentially compromising user privacy, but the flaw does not provide arbitrary code execution or a denial of service.

Apple iOS and iPadOS versions prior to 18.7.2, macOS Sequoia before 15.7.2, macOS Sonoma before 14.8.2, and macOS Tahoe before 26.1 are affected. The vulnerability is fixed in iOS 18.7.2, iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and macOS Tahoe 26.1.

The CVSS base score of 5.5 indicates moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a malicious or compromised app installed locally; the attacker would need to persuade a user to install the app or exploit a local code execution path. Given the low EPSS, the risk is moderate but still warrants prompt application of the vendor‑supplied fix.