Technical impact
The vulnerability stems from a missing user‑consent prompt that allows an application to request and retrieve data that is normally protected by the operating system’s privacy controls. Because the OS does not present a prompt, an app can read privileged data without the user’s explicit approval, resulting in a privacy violation. The weakness is an access‑control flaw, as described by CWE-284, and can lead to unauthorized disclosure of sensitive information.
Affected Systems
Apple operating systems running before the patches are affected. Specifically, iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, and visionOS 26.5 are vulnerable; later releases the added consent prompt.
Risk and Exploitability
The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% and absence from the CISA KEV catalog suggest that exploitation has not yet been widespread. The flaw is best exploited locally by a malicious or compromised application installed on the device; network‑based exploitation is not indicated. Because the issue is an access‑control failure rather than code execution, the risk is primarily privacy intrusion.
