An improper handling of symbolic links in macOS allows a root‑privileged application to read private data that should otherwise be protected. The vulnerability is classified as CWE‑59, indicating a path traversal issue where the operating system does not properly validate link targets before allowing access.

The issue affects Apple macOS prior to the release of macOS Sequoia 15.4. users running earlier macOS versions (e.g., Sequoia 15.3 or earlier) are susceptible until they update to the fixed version.

The CVSS score of 4.4 signals a moderate impact level, while the EPSS score of less than 1% reflects a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and it requires that the attacker already has root privileges on the system. Consequently, the risk is primarily relevant in environments where malicious or compromised root‑level processes could leverage the flaw to read sensitive files.