This vulnerability arises from a logging issue where sensitive user data was not properly redacted in system logs. An application that can read those logs could therefore obtain confidential information, such as passwords or personal identifiers. The flaw is classified as a data‑exposure weakness (CWE‑200) and carries a CVSS score of 5.5, indicating medium severity.

The issue affects Apple macOS across its releases until the fix is provided. Versions of macOS Sequoia earlier than 15.7.4 and macOS Tahoe earlier than 26.3 are impacted. System messages logged before installing the update may contain unredacted sensitive data.

The CVSS rating of 5.5 reflects a medium risk, and the EPSS < 1 % indicates a low probability that the flaw will be exploited in practice. Because the flaw requires an application to read local system logs, the attack vector can only be achieved from local or privileged processes; remote exploitation is not supported. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation activity. However, any attacker who obtains local control or can run a malicious app would be able to retrieve sensitive data from the logs.