A flaw in the handling of user preferences allows an application to gain access to sensitive personal information. The weakness is a classic case of improper protection of data leading to data leakage, identified as CWE‑359. The consequence is that an attacker who can run or influence an app on the device can obtain private data that should be restricted to the user.

The affected products are Apple’s mobile and desktop operating systems: iOS, iPadOS, macOS, visionOS, and watchOS. Devices operating on any version prior to 26.1 are susceptible; the issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, and watchOS 26.1.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, and no active exploitation is known. The typical attack vector would involve a malicious or compromised application installed on the device, as the flaw requires app access to the user preference subsystem. If exploited, the attacker could read sensitive data, potentially compromising user privacy and confidentiality.