An Apple-identified issue permits an app to override user privacy settings, exposing restricted data. The vulnerability results from code that remained accessible, allowing applications to read or infer information users had chosen to hide. Classified as CWE‑200, the breach undermines confidentiality and can enable further compromise.

Apple iOS 18.7.5 and older, iOS 26.3 and older, iPadOS 18.7.5 and older, iPadOS 26.3 and older; macOS Sequoia 15.7.4 and older, macOS Sonoma 14.8.4 and older, macOS Tahoe 26.3 and older. All affected Apple operating systems are listed under the Apple:iOS, Apple:iPadOS, and Apple:macOS vendors.

The base score of 7.1 indicates a moderate to high severity. An EPSS score of less than 1% suggests a low probability of public exploitation as of this analysis, and the issue is not yet included in the KEV catalog. Nonetheless, a successful attack could allow a malicious or compromised app to override privacy settings, potentially exposing extensive personal data. The attack vector is likely through a malicious application running with user privileges; therefore, the primary risk mitigation is updating to the patched OS releases.