A configuration issue in macOS allows a malicious or maliciously‑tricked application to trick a user into copying sensitive data to the system pasteboard, exposing that data to any application with pasteboard access. The weakness arises from insufficient access controls (CWE‑284) that permit an app to manipulate the clipboard without the user's explicit consent. This results in a confidentiality compromise where private information can be retrieved by other apps or the attacker.

Apple macOS versions earlier than the fixed releases are affected: Sequoia before 15.4, Sonoma before 14.7.5, and Ventura before 13.7.5. Devices running these unpatched versions may be susceptible to the pasteboard manipulation flaw.

The vulnerability carries a CVSS score of 9.8, indicating critical severity, yet the EPSS score is less than 1 %, pointing to a low likelihood of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog. Exploitation would require a malicious local application or social‑engineering effort to entice a user to paste sensitive data; no network‑based attack vector is described.