The issue was fixed by improving the handling of the secure input state, but prior to this fix an application could read sensitive user data through the compromised secure input state. This flaw enables the leakage of personal data, compromising confidentiality, without providing code execution or denial‑of‑service capabilities.

Apple macOS operating systems prior to the following releases are affected: Golden Gate versions earlier than 27, Sequoia earlier than 15.8, and Tahoe earlier than 26.7. The issue was addressed in these fixed releases. Devices running older macOS versions may allow malicious applications to read sensitive data through the compromised secure input state.

The EPSS score is < 1 % and the vulnerability is not listed in CISA KEV, indicating no currently known exploits. The CVSS score is 5.5, indicating moderate severity. Based on the description, the likely attack vector involves a local or third‑party app exploiting the secure input state to read data. The risk is therefore limited to environments with malicious or compromised apps, with a very low exploitation probability. No public exploitation reports exist.