An app can read sensitive user data due to insufficient privacy controls, reflecting a classic information exposure weakness (CWE-200). The vulnerability allows disclosure of protected information such as documents, credentials, or personal data, compromising user confidentiality without providing direct code execution capabilities. Based on the description, it is inferred that an attacker would need a malicious or compromised application installed on the target device to read this data.

Apple macOS systems running versions earlier than Sequoia 15.5 are affected. The defect was corrected in macOS Sequoia 15.5, so any version that has not been updated to that release remains vulnerable.

Based on the description, it is inferred that the vulnerability can be exploited by local actors through a malicious or compromised application, as no remote exploitation path is documented. The CVSS score of 5.5 places this issue in the moderate range, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation. The absence from the CISA KEV catalog further suggests limited exploitation activity so far.