Improper input validation allows a local attacker to modify the state of the Keychain, potentially inserting, altering, or deleting credentials and secrets stored on the device. This flaw can undermine the confidentiality and integrity of stored sensitive information and could facilitate authentication bypass or credential theft. The weakness aligns with CWE‑20: Improper Input Validation.

This vulnerability affects Apple’s operating systems on iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Versions addressed by Apple’s patch include iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. Devices running earlier releases remain vulnerable.

The attack vector is local; an attacker must be on the device or have local access to alter Keychain entries. The CVSS score of 7.5 indicates high severity, but the EPSS score of < 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. While no public exploit has been documented, the impact on key management and credential protection raises the severity for systems where Keychain is central to security. Updating to the patched OS versions mitigates the risk.