An authorization flaw in the operating system’s state management allows a sandboxed application to read entries from the System Keychain. By exploiting this weakness, a malicious app could retrieve sensitive credentials, certificates, or cryptographic material stored locally, potentially enabling credential theft or further compromise of user accounts.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. Versions prior to 27 for each platform include the vulnerability; the issue is fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.

Based on the description, the likely attack vector involves a sandboxed app installed from the App Store or via enterprise distribution, then using the state‑management flaw to read protected keychain entries. The CVSS score of 5.5 reflects a moderate impact, while the EPSS score of less than 1 % and absence from CISA KEV mean no known exploitation yet. However, the flaw grants read access to keychain data of all users, making credential theft a significant risk.