A vulnerability in macOS could allow a malicious application to read notifications from other iCloud devices, exposing sensitive personal information. The flaw originates from an improper handling of protected data, leading to unauthorized disclosure of private notification content, which is identified as a privacy violation (CWE‑200).

Apple's macOS operating system is affected, particularly versions earlier than macOS Tahoe 26.3, which contains the fix for this issue.

The CVSS score of 5.5 indicates a medium severity of the vulnerability, while an EPSS score of less than 1% implies a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local installation of a malicious application that can access iCloud notification data. No remote exploitation is mentioned, so the threat requires the attacker to have physical or remote access to install the malicious app.