This vulnerability exists in the logging subsystem of the Secure Access client for macOS before version 14.50. It is a format string vulnerability that can be triggered by an attacker who controls a modified server interacting with the client. Exploitation can cause the client to write unintended memory contents to log files, potentially leaking secrets. The CVSS 4.8 score reflects limited attack vector (local), low complexity, and limited impact confined to confidentiality leakage of a small memory portion. No official fix or remediation level has been published by the vendor as of the data provided.

An attacker with control over a malicious server can exploit this vulnerability to cause the Secure Access client to log portions of its memory, which may include sensitive information. This could lead to partial disclosure of secrets stored in memory. The impact is limited to confidentiality and does not include integrity or availability effects. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when connecting to untrusted servers with the affected Secure Access client versions. Monitor vendor communications for updates on patches or workarounds.