The flaw arises from improper state handling during device lock transitions on macOS. An attacker with physical access to a locked machine can retrieve sensitive user information, constituting an information exposure vulnerability (CWE‑200). The patch addresses the authorization issue by improving state management during lock events.

Apple macOS releases prior to Sequoia 15.7.4 and Tahoe 26.3 are affected. The security update fixes the defect in the mentioned versions, so devices still running earlier releases remain vulnerable.

With a CVSS score of 4.6 and an EPSS probability below 1 %, the risk is moderate but the likelihood of exploitation is low. Because the attack requires physical access to a locked device, it is not a network‑based threat and the vulnerability is not listed in the CISA KEV catalog. The most prudent assessment is that unauthorized users who gain physical access can read sensitive data, but the broader threat surface is limited.