A privacy issue with log entries allowed an application to read a user's contacts because sensitive data was not properly redacted. The flaw can lead to disclosure of private contact information to a capable application, violating user confidentiality. It is a type of information disclosure weakness as identified by CWE‑200.

Apple macOS versions up to and including macOS Tahoe 26.3 are affected. The fix was released in macOS Tahoe 26.3, so any system running an earlier release will be vulnerable.

The CVSS score of 3.3 indicates a low severity, and the EPSS score of less than 1% suggests a very low probability that this flaw will be exploited in the wild. It is currently not listed in the CISA KEV catalog. The likely attack vector is a local application running with user privileges that accesses the system logs, from which the application may extract unredacted contact data. No network or privilege escalation component is known from the description, so the condition for exploitation is the presence of a privileged or otherwise trusted application on the system.