The flaw is a session‑management issue in macOS. When Voice Control is enabled, a user may capture the output of another user's commands via the transcription feature. No escalation of privileges is required, and the issue does not affect application memory or execution. The primary consequence is a privacy breach, allowing one account to read actions performed by another account on the same device.

The vulnerability affects Apple macOS running any version before Sequoia 15.7.3, Sonoma 14.8.3, and Tahoe 26.2. All macOS releases prior to those patch versions are potentially vulnerable. Devices that have not applied the respective update from Apple remain at risk.

The CVSS score of 3.3 indicates low severity, and the EPSS score of less than 1 percent suggests that exploitation is unlikely at present. The flaw is not listed in CISA’s KEV catalogue, reinforcing its low exploitability. Attackors would need physical or logged‑in access to a device with Voice Control activated in the target account, making the attack vector local and constrained to devices that share the same user pool.