The vulnerability is an authorization flaw that allows an attacker who can physically access a locked macOS device to view sensitive information that should be protected by user credentials. The flaw is due to improper state handling during lock state transitions, which can expose the device's current session context to local processes. The impact is the potential disclosure of user data, including messages, files, and possibly login keys, which compromises confidentiality.

Affected Apple macOS releases include any version prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. The issue is resolved in those builds, so systems using older releases are vulnerable. The scope is limited to physical possession of the device while it remains locked, but the information that can be obtained could be sensitive to an attacker.

The risk level, as evaluated by current metrics, is that exploitation requires proximity and physical access, which reduces the likelihood of widespread attacks. However, the potential for private data exposure warrants prompt remediation. As the EPSS score is less than 1% and KEV is not listed, the severity is lower compared to remote‑exploitable vulnerabilities, yet the confidentiality impact remains serious.