A downgrade vulnerability in macOS permits an application to bypass code‑signing restrictions and access protected user data. The weakness, classified as a downgrade attack, can allow any installed app to read or potentially modify data that should be confined to the user’s secure environment.

Apple’s macOS operating system is affected. The issue is fixed in macOS Sequoia 15.6; all earlier releases are potentially vulnerable, though specific affected version ranges are not enumerated in the advisory.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation so far. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require the delivery of a malicious or tampered application to the user, potentially via the App Store or other installation mechanisms. Successful exploitation would provide an attacker with access to confidential user data. The overall risk is moderate, but the attack surface is limited and no widespread exploitation has been reported yet.