CVE-2024-23291 is a privacy issue in Apple iOS and iPadOS where a malicious application could potentially read sensitive user data from log entries related to accessibility notifications due to insufficient redaction of private data. Apple fixed this vulnerability by improving private data redaction in log entries. The fix is included in iOS 17.4 and iPadOS 17.4. The vulnerability has a CVSS 3.1 base score of 7.5, with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impacts confidentiality but not integrity or availability.

A malicious app running on affected iOS or iPadOS devices could observe sensitive user data through improperly redacted log entries related to accessibility notifications. This could lead to privacy breaches by exposing user information without authorization. The vulnerability does not impact system integrity or availability. There are no reports of exploitation in the wild.

Apple has released official patches for this vulnerability in iOS 17.4 and iPadOS 17.4. Users and administrators should update affected devices to these versions or later to remediate the issue. Since the vendor advisory confirms the fix, no additional mitigation steps are required beyond applying the update.