A parsing issue in how macOS handled directory paths allowed an application to bypass proper path validation, potentially granting it access to files that should be restricted. The vulnerability’s primary consequence is a confidentiality breach, where an attacker could read sensitive user data through a malformed path. This weakness is a classic example of improper input validation leading to a directory traversal flaw.

Apple macOS products are affected, specifically versions earlier than Sequoia 15.4. The fix is included in macOS Sequoia 15.4 and later releases. Users on older releases have not yet received the enhanced path validation and therefore remain vulnerable.

Exploitability information for this vulnerability is limited; the CVSS score is 5.5, the EPSS score is unavailable, and the issue is not listed in CISA’s KEV catalog. Because the weakness requires an application to be run to exploit the path parsing flaw, the likelihood of exploitation depends on the presence of malicious or compromised software on the victim’s system. Although the vulnerability does not provide code execution, exposure of user data is a significant privacy risk, especially on systems without timely patching. The absence of a publicly documented exploit suggests moderate risk, but the potential damage warrants prompt remediation.