The vulnerability arises from improper handling of symbolic links, allowing an application to bypass normal file permission checks and delete files that it should not be able to remove. This flaw is classified as an access control weakness (CWE‑862), and its exploitation would compromise the integrity of the operating system, potentially leading to data loss or system instability.

Apple provides a fix in several of its operating systems. On iOS and iPadOS, versions 18.4 or later contain the patch. macOS is protected from Sequoia 15.4 upward, from Sonoma 14.7.5 upward, and from Ventura 13.7.5 upward. The same update is included in tvOS 18.4, visionOS 2.4, and watchOS 11.4.

The CVSS score of 9.8 marks this as a critical flaw, but the EPSS score of less than 1% indicates that exploitation is currently unlikely in the wild. Since the vulnerability requires a local application to be executed, the attack surface is limited to systems where a malicious or compromised app has already been installed. The flaw is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been reported.