Technical impact
This vulnerability stems from a flaw in input validation (CWE‑20) that may allow an application to access sensitive user data, compromising confidentiality. The flaw is corrected in iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2.
Affected Systems
All Apple iOS, iPadOS, and macOS (Golden Gate) systems prior to the 27.2 update are affected. The issue is fixed in iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2.
Risk and Exploitability
The vulnerability enables apps that can bypass input checks to read user data. Based on the description, it is inferred that an attacker could distribute a malicious app or exploit an existing app with improper input handling; the likely attack vector is a user’s device when an offending application is installed. While the EPSS score is < 1% and the CVSS score is 5.5, and the vulnerability is not listed in the KEV catalog, the potential for data exposure makes it a moderate‑risk issue that should be patched promptly.
