An authorization flaw caused by improper state management enables an application to read or manipulate data that should be protected, leading to disclosure of sensitive user information. This weakness allows an attacker with sufficient access to an app or service to obtain confidential data. The vulnerability is not an arbitrary code execution flaw, but it does permit a user or malicious application to gain unauthorized access to information normally guarded by system controls.

Apple macOS systems, including macOS Sequoia, macOS Sonoma, and macOS Tahoe, as well as Apple watchOS devices are affected. The issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, and watchOS 26.6. Any earlier versions of these operating systems lack the state management fix and could be exploited.

The CVSS score of 5.5, and the EPSS score is less than 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread active exploitation. The attack vector is inferred to be local, requiring an application or user with installation or usage rights to an app capable of leveraging the faulty state handling. While no public exploit has been cited, the potential for data disclosure warrants prompt remediation.