This vulnerability is an authorization flaw arising from improper state management that allows an application to read sensitive user data it should not normally access. The flaw is present in macOS Sequoia versions before 15.8 and visionOS versions before 27, and was mitigated by a patch that improves state handling. If exploited, an app could exfiltrate personal content such as photos, contacts, or recordings.

Apple macOS Sequoia versions prior to 15.8 and visionOS versions prior to 27 are impacted. Devices running these OSes could allow apps to access sensitive data such as photos, contacts, or voice recordings.

The likely attack vector is a malicious or compromised app with sufficient installation privileges to reach the affected state management code on either macOS or visionOS. Based on the description, the exploit path requires such an app. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, but the potential for privacy breach is significant. The CVSS score of 5.5 indicates moderate severity. Attackers could target users by distributing malicious apps through the App Store or sideloading.