The vulnerability stems from insufficient validation of symbolic links, a CWE‑59 flaw that permits an application to read protected user files. By creating or manipulating a symlink, an attacker can cause a legitimate app to resolve a path to data that should remain private, thereby raising confidentiality risk for the user.

Apple macOS systems running versions prior to the fixes – Sequoia 15.4, Sonoma 14.7.5, and Ventura 13.7.5 – are affected. All earlier releases are vulnerable regardless of build or service pack level.

The CVSS score of 5.5 indicates moderate severity, and the EPSS value of less than 1% signals a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been reported. The likely attack vector requires an application that can create or modify a symlink pointing to a protected file; thus the risk is chiefly to users who install or run such applications.