A parsing issue in the handling of directory paths was identified and addressed by adding stricter path validation. The flaw permits a local application to resolve a file reference to a location outside the intended directory, potentially revealing sensitive user data. This classic directory traversal weakness (CWE-22) can expose confidential information if an attacker can run or otherwise influence a local app.

The vulnerability affects Apple macOS, specifically versions prior to macOS Sequoia 15.5, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3. These releases include the fix; any earlier releases remain vulnerable.

The CVSS score of 5.5 reflects moderate severity, and the EPSS score of less than 1 % indicates a low probability of exploitation on the current network landscape. The vulnerability is not currently listed in the CISA KEV catalog, but it remains a local risk: an attacker who can run or influence a local application can potentially read or tamper with protected files outside the intended directories. Without the mitigations, the impact is limited to confidentiality potentially compromised for the vulnerable user.