An application running on macOS may obtain access to sensitive user data owing to a flaw in the operating system’s data protection mechanisms. This vulnerability is identified as CWE‑200 and can lead to confidentiality loss for users, exposing information that should remain private.

All users of macOS versions preceding Sequoia 15.4 are affected, regardless of the device or setup. Once the 15.4 update is installed, the issue is fixed. The flaw does not discriminate between particular builds or configurations; any installation that has not applied the specified patch remains vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% shows low likelihood of widespread exploitation at this time, and the vulnerability is not currently listed in CISA’s KEV catalog. The attack is likely local, requiring an application to read protected data; a malicious or compromised app could trigger the data exposure, but no network‑remote exploitation is indicated by the available information.