The vulnerability arises from a flaw in the operating system’s data protection mechanisms, allowing applications to access user information beyond the limits intended by the user or the system. This could result in unauthorized disclosure of personal data such as contacts, messages, or other sensitive content, thereby compromising confidentiality. The weakness is indicative of improper access controls, with a potential for broad data leaks.

Apple iOS, iPadOS, macOS (Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6), tvOS, visionOS, and watchOS are affected. The fix has been released in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Devices running earlier releases remain vulnerable.

No public exploit has been reported and the EPSS score is <1%; the vulnerability is not cataloged in CISA KEV. Nonetheless, the risk of data exposure is significant, especially if a malicious or compromised application can be installed. The likely attack vector is the introduction of an app with elevated data‑access privileges, either through the App Store, sideloading, or other means. With no current exploit evidence, the threat appears moderate to high based solely on the potential impact on data confidentiality.