A permissions flaw permits an application to read sensitive location data that it should not be allowed to access. The weakness, classified as CWE‑284 Access Control, could lead to unauthorized disclosure of geolocation information, compromising user privacy and confidentiality without affecting system integrity or availability.

Apple macOS is impacted. The vulnerability is present in versions prior to macOS Tahoe 26, which supplies the fix. Users of older macOS releases face the risk of applications gaining unintended location access.

The CVSS score of 5.5 reflects moderate severity, while the EPSS score of less than 1% indicates low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require an application that is installed on the local machine and granted location permissions; a malicious developer could install a seemingly benign app to harvest a user’s location data. Because the issue is a permissions oversight rather than an arbitrary code execution flaw, the attack surface is limited to the local environment and user acceptance of app permissions.