Technical impact
Apple identified an issue where operating‑system checks were incomplete, allowing an application to read sensitive user data. The vulnerability stems from insufficient validation of system permissions, which could lead to confidentiality loss if a malicious or compromised app can access data it should not be able to read. The fix, released in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, and tvOS 27.2, adds the necessary checks to prevent this unauthorized access. The affected devices are inferred to be those running iOS, iPadOS, macOS, or tvOS versions 27.1 or earlier, as the security notice specifies that the 27.2 update addresses the issue. Apple devices that have not updated beyond these versions are likely impacted because the patch message highlights that the problem was resolved only in 27.2. The CVSS score of 3.3 and the EPSS score of < 1% are available, so the severity and exploitation likelihood can be quantified. The likely attack vector is local, driven by a rogue application that a user might install from the App Store or be tricked into running; the vulnerability would allow that application to read any sensitive content it can normally access through the system. Because the issue is not listed in the CISA KEV catalog, and the exploit requires a local app, the overall risk remains real if users run older OS versions.
Affected Systems
Apple iOS, iPadOS, macOS (Golden Gate), and tvOS operating systems running version 27.1 or earlier are affected. These include iOS 27.1 and below, iPadOS 27.1 and below, macOS Golden Gate 27.1 and below, and tvOS 27.1 and below. Devices running the 27.2 release or later are not impacted.
Risk and Exploitability
Because the CVSS score of 3.3 and the EPSS score of < 1% are available, the vulnerability is characterized as low severity. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been publicly confirmed. However, the potential for data exposure exists if an application on an affected device can bypass permission checks. The attack vector appears to be local, relying on a malicious or compromised app to be installed or executed. If such an app runs with user privilege on an older OS, it could read any data the system normally protects, leading to confidentiality compromise. System administrators should therefore prioritize upgrading to 27.2 or later and consider monitoring for unusual app behavior.
