A sandboxed application may be able to read sensitive data from system logs, allowing disclosure of confidential information. The weakness is a lack of proper isolation of log data, classified as CWE‑200. An attacker could compromise user privacy by extracting private credentials or system details from log files.

Apple macOS systems prior to the release of Sequoia 15.4 are potentially affected. The fix is available in macOS Sequoia 15.4 and later, but earlier macOS versions remain vulnerable.

The CVSS score of 5.5 indicates a medium impact, while the EPSS score of less than 1% suggests a very low probability of exploitation in the current environment. The vulnerability is not listed in CISA’s KEV catalog, reducing urgency, but the attack vector likely requires local or sandboxed privilege. Organizations should assess the presence of sandboxed apps with log‑reading capabilities and update promptly.