The vulnerability arises from inadequate input validation within macOS components, allowing an application to bypass standard safeguards and read data that should remain private. Because the guardrails are weakened, an attacker can retrieve documents, settings, or other personal information that the operating system otherwise protects. The flaw does not provide a means for code execution or denial of service, but it can expose confidential data if exploited locally or remotely via a compromised application.

Apple macOS is affected. Versions prior to macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26 are vulnerable. These releases lack the input‑validation improvements that lock access to sensitive files and user information.

The CVSS score of 5.5 indicates moderate severity; the EPSS score of less than 1% suggests current exploitation probability is very low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to convince a user to run a malicious app or leverage a local exploit; the path is limited to applications that process untrusted input. No remote code execution or privilege escalation is enabled by the flaw.