An application can exploit improper validation of environment variables, allowing it to modify protected areas of the file system. This flaw provides local privilege escalation because the attacker can write or replace files in system directories typically restricted to elevated users. The weakness is a classic input validation failure (CWE‑20). The impact is that the attacker can gain increased capabilities by altering critical system files, potentially compromising system integrity and stability. Overall, the vulnerability can be used to step beyond the application’s intended permissions and affect system security.

Apple macOS, specifically macOS Sequoia versions older than 15.4, which lack the patched validation logic. Any system running those releases is susceptible.

The CVSS score of 5.5 suggests moderate severity, while the EPSS of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires a malicious or compromised application running with user privileges, which then injects crafted environment variables. Once the unsafe environment is in place, the application can perform file system modifications that would normally be restricted.