The flaw stems from inadequate validation of symbolic links by the macOS file system. An application that is able to run on the machine can create symlinks that point to system‑protected regions. If such a symlink is later used by a privileged process, the attacker can read, modify, or overwrite critical files, effectively enabling remote code execution or privilege escalation. This weakness corresponds to CWE‑59, dangling symlink exploitation.

Apple macOS operating systems are affected, including all releases older than Sequoia 15.4, Sonoma 14.7.5, and Ventura 13.7.5. The issue was fixed in those releases and later.

The CVSS score of 9.8 highlights a severe risk. The EPSS score of less than 1 % indicates low current exploitation probability, and the flaw is not listed in CISA’s KEV catalog. Because the vulnerability requires a malicious application that has permission to create symlinks, the most likely attack vector is local installation of malware, though a compromised application could propagate the exploit unnoticed. Once a valid symlink points to a protected file, privileged processes that follow it can be hijacked, providing widespread control over the affected system.