A local attacker can bypass permissions checking to access a user's Keychain items, exposing stored passwords, certificates, and other sensitive credentials. The weakness is a failure to properly enforce access control (CWE-863). The compromised data can lead to credential theft, further attacks, or unauthorized system access, affecting the confidentiality and integrity of user data.

Apple iOS, iPadOS, macOS, visionOS, and watchOS. Versions affected include iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, and watchOS 26.4.

The CVSS score of 3.3 indicates low severity, and the EPSS score is less than 1 percent, suggesting a very low probability of exploitation. The vulnerability is not listed in the KEV catalog. Because the attack requires local device access, it is most relevant to situations where an attacker can physically or remotely interact with the device while the user is logged in or has provided authentication. No public exploit is known, and the simplified fix is to update to the patched OS releases.