The vulnerability is caused by missing entitlement checks that allow an application to access sensitive information it should not be permitted to read. The weakness consists of improper authorization through entitlement misconfiguration, which can lead to accidental or malicious leakage of personal or confidential user data. The potential impact is the disclosure of sensitive information to a user or application that lacks the necessary entitlement, thereby violating confidentiality.

Apple’s iOS, iPadOS, and macOS are affected. The defect exists in any release prior to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread abuse. An attacker would need to supply or manipulate a third‑party application that can trigger the missing entitlement checks; once such a payload is installed, the compromised app can read privileged data. No publicly documented exploit exists at present, so the most prudent response is to apply the vendor’s fix.