Technical impact
The vulnerability arises from a logging flaw that was addressed by improving data redaction in Apple operating systems. The flaw allows an application to read kernel memory layout through logs, potentially exposing sensitive internal state. This could lead to an attacker inferring privileged information that might be leveraged for further attacks, though it does not directly grant code execution.
Affected Systems
Affected systems include Apple iOS, iPadOS, macOS, tvOS, and watchOS. The vulnerability exists in versions older than iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Sequoia 15.7.7, Sonoma 14.8.7, Tahoe 26.5, tvOS 26.5, and watchOS 26.5.
Risk and Exploitability
The CVSS score of 7.5 indicates high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. It is typically exploited through a local app that reads log files or via a compromised application that can access the logging subsystem. Given that it reveals kernel memory layout, the risk is primarily confidentiality; an attacker could use the information to craft more targeted exploits. Monitoring for anomalous logging activity and applying the vendor patches are prudent.
