An access issue in macOS allows a local application to read sensitive data that it should not be able to reach, due to insufficient sandbox restrictions. The flaw is classified as CWE‑284, indicating a lack of proper access controls. If an attacker can employ a malicious or compromised app, the result is the unauthorized exposure of user information without requiring further privileges.

Apple macOS, specifically versions older than macOS Sequoia 15.4 and macOS Sonoma 14.7.5. Users running earlier releases of these operating systems are affected until the patch updates are installed.

The vulnerability carries a CVSS score of 5.5, suggesting moderate severity, and an EPSS score of less than 1%, indicating a low chance of exploitation so far. It is not listed in the CISA KEV catalog, which further suggests a limited threat window. The likely attack vector is local exploitation via a sandbox‑bypass technique employed by a malicious application. Exploitation requires the attacker to run a privileged or privileged‑sous‑privilege app that can circumvent the enhanced sandbox controls. Current mitigation involves installing the latest OS update; without it, the risk remains present.