Technical impact
The vulnerability involves a parsing error in directory path handling that can allow a local application to read files marked as protected. It falls under the path traversal or directory traversal category (CWE‑22) and results in a confidentiality breach by exposing user data that should be inaccessible outside the user’s protected environment.
Affected Systems
Affected systems are Apple macOS operating systems. The flaw was remedied in macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7, meaning that earlier releases of the same major versions remain vulnerable until those updates are applied.
Risk and Exploitability
The base CVSS score of 4 indicates moderate severity, while the EPSS score of less than 1% reflects a very low expected exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local and requires an application to manipulate path parsing; thus an attacker can achieve unauthorized local read access to protected user data mainly through a compromised or malicious local application.
EUVD