A logic flaw in macOS allows a sandboxed application to read sensitive user data that it should not normally be able to access. The weakness is a failure of authorization checks, identified as CWE‑284, and could expose personal documents, emails, or other private information. This vulnerability does not provide remote code execution or system compromise, but it enables unauthorized data disclosure while keeping the app confined to a sandboxed environment.

Apple macOS is affected in versions that do not incorporate the patch: macOS Sequoia prior to 15.5, macOS Sonoma prior to 14.7.6, and macOS Ventura prior to 13.7.6. All earlier releases lacking the updated checks remain vulnerable.

The CVSS score of 7.1 reflects a moderate to high risk when a malicious sandboxed app is present. The EPSS score of less than 1% indicates that exploitation is unlikely but not impossible, and the vulnerability is not yet listed in CISA's KEV catalog. Exploitation would likely occur locally or through a trusted application distributed to the system, and the attacker would gain access exclusively to the data the sandboxed app can read.