A library injection vulnerability in macOS allows an application to load malicious libraries, potentially modifying protected areas of the file system. This flaw represents a data exposure weakness, classified as CWE‑200, and could lead to unintended changes in critical system files or data integrity issues based on the attacker’s needs.

Apple macOS, specifically versions prior to Sequoia 15.4. The fix was released in macOS Sequoia 15.4, so any installation of macOS Sequoia 15.0 through 15.3 remains vulnerable.

The CVSS score of 5.5 indicates a medium severity vulnerability, while an EPSS score of less than 1% shows a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector involves a malicious or compromised application that injects an unauthorized library into a privileged process; the attacker would need local execution or control over an approved app to exploit the weakness.