An application may use improper handling of symbolic links to read files outside the intended directories, thereby gaining access to protected user data. This vulnerability enables an app to bypass the boundary that normally restricts file access, leading to a breach of confidentiality for the affected user(s). The flaw exists because the operating system does not sufficiently validate or sanitize symlink targets before allowing a program to follow them.

Apple macOS operating systems are affected. The issue is fixed as of macOS Sequoia 15.4, meaning versions prior to Sequoia 15.4 remain vulnerable unless an upgrade is performed.

The CVSS score is not provided and EPSS is not available, therefore the precise exploitation likelihood cannot be quantified. The vulnerability is listed as not included in the CISA KEV catalog. Based on the description, the attack vector requires an application to create or use a symlink pointing to a protected file; thus it is an application‑level local flaw that could be exploited if malware or a compromised app runs with user privileges. Without specific metrics, the risk remains that any process capable of generating symlinks could read sensitive data.