A flaw in the macOS sandbox allows a sandboxed application to create or follow a symbolic link that points outside the permitted directory tree. By exploiting this, the application can read or modify files that should be protected, potentially executing arbitrary code or leaking sensitive data. This weakness corresponds to CWE‑59, improper handling of path traversal.

Apple macOS releases prior to Sequoia 15.6 are impacted. The 15.6 update contains the fix, so any system running an earlier version remains vulnerable. The vulnerability is relevant to any application that operates within the standard macOS sandbox environment.

The CVSS score of 8.7 indicates a high severity, while the EPSS score below 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be local or partially local, as the payload does not describe a network‑exposed path; an attacker would need to supply input to a sandboxed application or gain the ability to run code within the sandbox to exploit the symlink handling flaw.