Technical impact
The vulnerability stems from inadequate message validation that permits an application to send a crafted input to a system component, leading to elevated privileges. This flaw is classified as CWE‑276, which relates to improper enforcement of privilege restrictions. An attacker who can run or influence the vulnerable application may achieve unauthorized privilege escalation, compromising system integrity and confidentiality.
Affected Systems
Affected Apple macOS systems include versions prior to macOS Sequoia 15.3, which implements the fix. All earlier releases of Sequoia (e.g., 15.2 and earlier) remain susceptible until the update is applied. Users running older macOS iterations are at risk if they install or run applications that can exploit the message validation weakness.
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity, but the EPSS score of below 1% suggests a very low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog, reinforcing its lower exploitation risk. Nevertheless, if deployed in an environment with untrusted applications, the flaw could be leveraged locally by sending malicious messages, so it should be patched promptly.
EUVD