A permissions flaw in macOS allows an application to access protected user data that it should not be able to reach. The weakness is an access control issue (CWE-284). The impact is primarily the confidentiality of user data, as the compromised application could read sensitive files or information. The CVSS score of 5.5 indicates a moderate risk, and the low EPSS score (<1%) suggests that exploitation is unlikely in the current landscape. The vulnerability does not appear in the CISA KEV catalog, reinforcing that it has not yet been widely exploited by known adversaries.

Apple macOS is affected. Systems running macOS Sonoma before version 14.8 or macOS Tahoe before version 26 are vulnerable. The issue is resolved in macOS Sonoma 14.8 and macOS Tahoe 26, so any earlier releases remain at risk unless updated.

The risk level is moderate, driven by the CVSS score of 5.5. The very low EPSS score indicates a low probability of active exploitation at present. The vulnerability is exploitable locally by any application that can run on the system, which may be achieved through malicious or compromised software. While the vulnerability is not currently listed in the CISA KEV catalog, monitoring for new exploits is advisable.