This flaw stems from improper state management in macOS that allows a malicious application to read any file on the system. The weakness matches CWE‑862, Failure to Check Permissions before Performing an Operation, enabling unauthorized data access. The CVE description does not reference integrity or denial‑of‑service impacts, so the effect is confined to the acquisition of sensitive information.

Apple macOS is affected. The issue is fixed in macOS Sequoia 15.3, so all releases before 15.3 are vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 % signals a very low probability of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. The reference to a “malicious app” suggests the attack vector is local or user‑initiated; an attacker would need to compile or distribute a compromised application that the user runs.