An authentication weakness in multiple Apple operating systems allows an application to read and leak sensitive kernel state that it should not have access to. The flaw enables information disclosure about internal system structures and potentially permits further compromise of device security. It is a classic information‑exposure vulnerability where privileged data becomes available to unauthorized code.

The affected platforms are iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Versions prior to iOS 18.7.7 and iPadOS 18.7.7, before macOS Sequoia 15.7.5 and macOS Tahoe 26.4, before tvOS 26.4, visionOS 26.4, and watchOS 26.4 are vulnerable to this kernel state leak.

The CVSS score of 6.2 indicates moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, indicating no widespread active exploitation sightings. The likely attack vector is local: a malicious or compromised application running on the device could trigger the unauthenticated read of kernel data, but the vulnerability does not appear to allow remote exploitation through network interfaces.