An authorization flaw caused by insufficient state management can allow a malicious or compromised application to access user data that it should not be able to see, leading to disclosure of sensitive information. The weakness is an improper access control issue that could expose confidential data to other apps or to the attacker. This compromise affects the confidentiality of user data for any affected device.

The vulnerability is fixed in iOS 18.4, iPadOS 18.4, and macOS Sequoia 15.4; the description does not specify the exact version range of affected systems, so it is reasonable to assume that earlier releases may also be vulnerable.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is not available. Based on the description, it is inferred that attackers would need to deliver or install a malicious app that exploits the state‑management issue, making the attack vector likely local or requiring privileged application installation. The risk to users is primarily confidentiality loss, and the lack of an EPSS score suggests exploitation probability is not currently high, yet the defect is fixed in the newest releases.