The vulnerability allows an application to read sensitive user data that it should not be able to access, due to insufficient privacy controls in the operating system. This constitutes an information disclosure flaw. The flaw could expose personal, location, or health data to a malicious or compromised app, compromising user confidentiality. The weakness is an exposure of sensitive information, typical of a privacy control failure.

Apple devices running iOS, iPadOS, macOS, visionOS, or watchOS are affected. The fix is deployed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, and watchOS 26.2. Any earlier versions of these operating systems are vulnerable.

The CVSS score of 3.3 indicates low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is through a local or sandboxed application that privileges exceed ordinary app boundaries, potentially via a flaw in the operating system’s privacy enforcement. Because the attack path relies on installing or compromising a legitimate app, the exploitation prerequisites are minimal for an attacker who can deliver a malicious application to the device.