This vulnerability allows an application to capture keyboard input events while the macOS device is on the lock screen, potentially exposing sensitive user input. The issue arises from improper state management that allowed keyboard events to be intercepted by an app when they should have been blocked. Apple has fixed this vulnerability in macOS Sequoia 15.2, Sonoma 14.7.2, and Ventura 13.7.2 by improving the handling of input event states on the lock screen. The CVSS 3.1 base score is 5.5, reflecting medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker with a malicious app installed on a vulnerable macOS system could capture keyboard input from the lock screen, potentially exposing sensitive information typed by the user before authentication. This could lead to confidentiality breaches. There is no impact on system integrity or availability. No known exploits are currently reported in the wild.

Apply the official security updates provided by Apple by upgrading to macOS Sequoia 15.2, macOS Sonoma 14.7.2, or macOS Ventura 13.7.2 or later. These updates contain the official fix through improved state management. Until patched, avoid installing untrusted applications and be cautious with user interaction on locked devices. Patch status is confirmed by the vendor advisory.