Technical impact
A logging mechanism failed to properly redact data, potentially allowing an application to observe sensitive kernel state. The flaw means that, when logs are generated, kernel details might be written in clear text and exposed to adversaries that have access to those logs. The core weakness is a lack of adequate data redaction before persistence of log records, which can lead to unintended disclosure of protected information.
Affected Systems
The vulnerability is present in Apple operating systems including iOS, iPadOS, macOS, tvOS, and watchOS. Affected releases are iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5. Devices running these or older versions are at risk.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity vulnerability, while the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation has been reported. Nevertheless, the flaw can leak kernel‑level data via application logs, providing attackers with information useful for further attacks. The likely attack vector is an application with high privileges that writes detailed logs to the system logging facility.
