The vulnerability arises from missing permission checks that allow a malicious application to elevate its privileges to the system level. Classified as CWE‑280, it involves improper privilege management. A user who can install or run an untrusted app on the affected macOS can therefore gain root access, enabling full control over the system.

Apple’s macOS operating system is affected, specifically versions before Sequoia 15.4, Sonoma 14.7.6, and Ventura 13.7.6. Systems running these earlier releases may be exploited by a local or user‑initiated attacker.

The CVSS score of 7.8 indicates high severity; however, the EPSS score of less than 1% points to a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to install or execute a malicious app on the target device, a local attack scenario, and could result in complete system compromise if successful.