A path handling flaw allows a malicious application to read data that should be protected. The weakness is a file path validation error that can grant an app unauthorized access to private files, resulting in a confidentiality compromise. The impact is limited to read‑only access to those files and does not enable arbitrary code execution.

The vulnerability affects Apple’s mobile and desktop operating systems. Systems prior to iOS 18.4 and iPadOS 18.4 are affected, as well as macOS versions older than Sequoia 15.4 or Sonoma 14.7.5. On television and wearable devices, tvOS 18.4 and watchOS 11.4 are the latest releases that contain the fix, meaning earlier tvOS and watchOS versions remain vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% shows exploitable workloads are very rare. The vulnerability is not listed in CISA’s KEV catalog. The attack vector appears to be local, requiring an adversary to install a malicious app on the device. Once installed, the app can use the flawed path handling to read restricted data, but no elevation of privilege or code execution is required. Updating to the fixed OS releases mitigates the risk.