An attacker with physical access can inject arbitrary keyboard events into any applications running on a macOS device that is locked, potentially enabling the attacker to execute unintended commands, capture sensitive input, or otherwise disrupt user activity. The vulnerability stems from insufficient state management in input handling and is classified as CWE-288, indicating a failure in authentication or message integrity.

Apple macOS versions prior to Sequoia 15.1 are affected, including Sequoia 15.0 and earlier. The fix was incorporated in macOS Sequoia 15.1, so all releases before that are vulnerable.

The CVSS score of 7.5 indicates high severity, but the EPSS score of under 1% suggests a low likelihood of public exploitation. The vulnerability is not listed in the CISA KEV catalog, and it requires physical presence on the device to perform the attack. If exploited, the attacker can manipulate any running application while the device is locked, potentially leading to data exposure or unauthorized control.