This vulnerability arises from improper state management in macOS, allowing a local application to acquire root privileges. The weakness is a classic privilege escalation flaw, identified as CWE‑269. The CVSS score of 7.8 indicates high severity, meaning that any successful exploitation would grant an attacker full system control.

Apple macOS installations running versions earlier than Sequoia 15.6 or Sonoma 14.7.7 are vulnerable. The patch introduces improved state handling that prevents the escalation path. Users should assess whether their current macOS version precedes the specified fixes.

The EPSS score of less than 1% suggests that, as of the latest data, the likelihood of this exploit being actively used is very low and the vulnerability is not recorded in the CISA KEV catalog. However, the nature of the flaw still grants unrestricted system access; the attack vector is inferred to be local, requiring the attacker to run a malicious or compromised application on the affected machine. Given the high criticality of root access, organizations should not wait for external exploitation reports before applying the fix.