The vulnerability is a logic flaw that allows a sandboxed application to bypass intended access controls and read sensitive user data. This flaw results in an unauthorized disclosure of data and is classified as CWE-284 Improper Access Control. No special user action is required beyond normal app usage.

The issue affects Apple macOS versions that were released before the update that fixes the logic issue. Specifically, any release prior to macOS Sequoia 15.4, macOS Sonoma 14.7.5, or macOS Ventura 13.7.5 remains vulnerable.

With a CVSS score of 7.4 the vulnerability carries a high severity rating, while the EPSS score of less than 1% indicates a very low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a malicious sandboxed application that a user installs, which can then exploit the logic error to access protected data; this inference is based on the description of the vulnerable behavior.