This vulnerability stems from inadequate state information handling, enabling a malicious or poorly configured application to read internal state values it should not access. The affected operating systems can be patched through the updates listed, and until then, an app may access sensitive user data. The weakness is catalogued as improper resource handling (CWE‑664).

Affected Apple operating systems are all versions before the stated security updates: iOS and iPadOS prior to 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, tvOS, visionOS and watchOS before 26.6. Devices running these operating systems are vulnerable regardless of device type.

The CVSS score of 5.5 reflect a moderate impact; the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. However, any application that can be installed on the device could potentially exploit the flaw, so the risk to confidentiality remains significant. Based on the description, the likely attack vector involves delivery or execution of a malicious or improperly configured application, which is a realistic scenario in environments with weak app vetting or jailbroken devices. Because the vulnerability is not listed in the CISA KEV catalog, no widespread exploitation campaign has yet been reported.