An injection flaw in macOS was discovered, wherein an application could inject malformed input to bypass data validation. The vulnerability is classified as an information exposure issue (CWE‑200) and permits an attacker to read sensitive user data from the affected system. The flaw does not grant code execution or privilege escalation; its primary impact is confidentiality loss.

Apple macOS is affected, with the issue addressed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Any earlier releases that have not applied these updates remain vulnerable. The vulnerability applies to the operating system itself, so the resilience of any installed third‑party software also depends on those updates.

The CVSS score of 9.8 signals a critical severity. However, the EPSS value of less than 1 % indicates that, as of now, exploitation opportunities are very low. The vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. It is inferred that the attack vector relies on injection of crafted input, likely from a local application, rather than remote attack. The expected consequence is data compromise with minimal other system impacts.