The vulnerability is an access issue that allows an application to read protected user data from the system pasteboard, representing an instance of unauthorized access (CWE‑862). The description indicates that insufficient sandbox restrictions on the pasteboard can expose protected information; it is inferred that an attacker would need a local or sandboxed application to exploit this capability.

Apple macOS is affected; any build preceding Sequoia 15.4 contains the flaw, while Sequoia 15.4 and later include the sandbox fix.

The CVSS score of 9.8 flags a critical threat. The EPSS score of less than 1 % implies that exploitation is currently unlikely to be widespread. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local, involving a sandboxed or ordinary application that can read the pasteboard. The published fix in Sequoia 15.4 restores proper sandbox restrictions to prevent such unauthorized reads.