The vulnerability is an access control flaw that allows a compromised application built with Xcode to read and write files outside of its intended sandbox boundary. This can lead to the compromise of confidential system files, tampering with application data, and potentially local privilege escalation if the attacker can manipulate files crucial to system or other app integrity. The flaw is rooted in inadequate sandbox validation, consistent with the CWE-284 classification.

The affected product is Apple Xcode. Versions prior to Xcode 26 are susceptible because the issue was addressed and fixed specifically in Xcode 26. The CVE does not list exact versions, so any build of Xcode 25.x or earlier that compiled the vulnerable applications is considered at risk.

The CVSS score of 7.1 indicates a moderate to high severity, and the EPSS score of less than 1% suggests that the likelihood of exploitation is low, with no known public exploits reported and the vulnerability not listed in CISA KEV. The attack vector is inferred to be local, requiring the attacker to influence a build process or execute the resulting application with the sandbox bypass. Because the flaw is tied to the development environment, it most likely affects developers or build systems that use older Xcode releases.