Technical impact
An application can modify protected file system components, allowing it to overwrite critical system files or binaries. This permission bypass creates a clear path toward privilege escalation and potentially enables arbitrary code execution. The weakness corresponds to CWE-732 and is rated with a CVSS score of 9.8, indicating a critical severity level. The exploit probability, as reflected by an EPSS score of less than 1%, is low but nonzero, so while the likelihood of widespread exploitation is modest, the consequences are severe.
Affected Systems
Apple macOS systems running any version that predates the security update are vulnerable. The fix appears in macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7. Users operating older releases of these operating systems are at risk; no specific patch versions are listed beyond those releases.
Risk and Exploitability
With a CVSS of 9.8 the vulnerability carries a critical rating, and although an EPSS score below 1% indicates rare use, the attack vector is likely local through the installation or execution of a privileged application. The vulnerability is not currently listed in the CISA KEV catalog, reducing evidence of active exploitation, but the potential for system compromise remains high if a malicious app gains the necessary permissions.
EUVD