A flaw in Apple operating systems lets an installed application read user data that it should not access. The vulnerability arises from insufficient authorization checks when accessing sensitive system information. This can lead to the disclosure of contacts, messages, or other personal data, compromising confidentiality. The weakness maps to CWE-200 (Information Exposure).

Apple iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 contain the fix. All versions older than those listed are vulnerable.

The CVSS score of 5.5 indicates moderate impact, and the EPSS score of <1% implies a low likelihood of exploitation. The vulnerability is not listed in CISA KEV, and no public exploits are documented. Based on the description, it is inferred that the attack vector is local, requiring a malicious or poorly designed third‑party application to read protected data. The lack of a KEV listing and the low EPSS score reduce the urgency, but the potential to exfiltrate private data warrants timely patching.