This vulnerability arises from inadequate file handling that permits an application to read the user’s contacts database, exposing personal data. The flaw aligns with the data‑exposure weakness CWE‑200 and does not provide remote code execution or denial of service; it simply allows an unauthorized app to access sensitive contact information.

Apple macOS is affected. Versions of macOS Sequoia, Sonoma, and Ventura prior to the 15.4, 14.7.5, and 13.7.5 releases, respectively, are vulnerable. The fix is included in those patch releases, but earlier builds lack the remediation.

The CVSS score of 4.3 indicates moderate risk. The EPSS score of less than 1 % suggests the probability of exploitation remains low, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need to deliver a malicious application and rely on local execution or a user’s approval; the attack vector is therefore inferred to be local rather than remote.