A logging issue within Apple operating systems allowed an application to access sensitive user data that should have been redacted. The vulnerability results in the potential disclosure of private information logged by the system, leading to information compromise. It is linked to CWE-200, which concerns unauthorized disclosure of information. This flaw does not grant code execution, privilege escalation, or denial of service; it is focused solely on privacy intrusion.

The affected products are Apple iOS, iPadOS, macOS, visionOS, and watchOS. The flaw resides in the operating system logging components of these OS families and is fixed in the following releases: iOS 18.7.3 and 26.2, iPadOS 18.7.3 and 26.2, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, and watchOS 26.2. The exact versions susceptible are those listed above; newer releases include the patch.

The CVSS score of 3.3 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. The vulnerability is not currently listed in the CISA KEV catalog, implying limited or no known exploitation. The likely attack vector inferred from the description is that an application with local execution privileges could read logs containing unredacted sensitive data. An attacker would need to run a malicious or compromised app on the device, interact with the logging subsystem, and obtain the undredacted entries. No additional conditions or prerequisites are documented, but the effect remains confined to data disclosure rather than system compromise.