The vulnerability results from missing entitlement checks in macOS, allowing an application to read sensitive user data that it should not normally access. This flaw does not grant broader privilege escalation; it simply relaxes the normal authorization safeguards that prevent certain apps from accessing protected information. Consequently, an attacker who can run or influence an application on the affected system could expose confidential files, credentials, or system settings.

Apple macOS versions prior to Sequoia 15.6, Sonoma 14.7.7, and Ventura 13.7.7 are affected. These systems have not received the entitlement check fix and remain vulnerable.

The CVSS score of 4 classifies the flaw as low to moderate severity, and the EPSS score of less than 1% indicates that exploitation is currently unlikely. It is not listed in the CISA KEV catalog. The likely attack vector is a local or software-based scenario where a malicious or misconfigured application runs in the user’s context and exploits the missing checks to read protected data. While the risk to environments that have not applied the patch is modest, the potential loss of sensitive information warrants timely remediation.