This vulnerability involves a format string issue in the logging component of the Secure Access client for macOS before version 14.50. An attacker who can control a malicious server can exploit this flaw to manipulate log output, causing the client to dump small memory contents into log files. This may lead to unintended disclosure of sensitive data. The CVSS 4.0 vector indicates local attack vector with low complexity and low privileges required, no user interaction, and low impact on confidentiality. No official remediation or patch has been documented by Absolute Software as of the publication date.

The vulnerability could lead to partial disclosure of memory contents through log files, potentially revealing secrets or sensitive information stored in memory. The impact is limited by the requirement that the attacker must control a modified server and have local access conditions as indicated by the CVSS vector. There is no indication of privilege escalation or remote code execution. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when connecting to untrusted or modified servers with the Secure Access client. Monitoring for updates from Absolute Software is recommended to apply any forthcoming patches promptly.