A logic issue in the spellcheck API allows an application to access files that it should not normally be able to reach. The flaw is an improper access control weakness, identified as CWE‑284, and the default CVSS score of 3.3 indicates a low severity vulnerability. The available description does not specify the breadth of potential data compromise, but the mechanics could lead to unauthorized reading of local files, affecting confidentiality.

Apple iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, and watchOS 26.2 are affected by this issue.

The CVSS score is 3.3 and the EPSS score is less than 1%, meaning exploitation is considered unlikely. The vulnerability is not catalogued in the CISA KEV list. The attack vector is inferred to be via a local or system application that interacts with the spellcheck API; the description does not explicitly mention remote exploitation. Consequently, the risk to affected systems remains low, although an attacker with the ability to install or run an application on the device could exploit the flaw to read restricted files.