A logging issue caused notifications that were marked for deletion to remain on the device, preventing the intended data redaction. This flaw can lead to exposure of sensitive information that users expected to be removed, compromising the confidentiality of personal communications and other confidential data accessed locally. Based on the description, it is inferred that an attacker would need local or physical access to read the retained notification content.

Apple iOS and iPadOS devices running any version older than iOS 15.8.8, iOS 16.7.16, iOS 18.7.8 or iOS 26.4.2, as well as any iPadOS version older than iPadOS 15.8.8, iPadOS 16.7.16, iPadOS 18.7.8 or iPadOS 26.4.2 are affected. The flaw has been fixed in the corresponding release versions listed above.

Based on the description, it is inferred that the likely attack vector is local access to the device; there is no reported network exploitation path. The EPSS score is less than 1 %, indicating a very low probability of real‑world exploitation, and the vulnerability is not listed in the CISA KEV catalog. With a CVSS score of 6.2, the risk is considered low to moderate, contingent upon the sensitivity of the data contained in the deleted notifications.