This vulnerability arises from missing entitlement checks that allow an executable running with root privileges to bypass access controls and read private data that should be protected. The flaw is classified as missing authorization and could lead to accidental or intentional exposure of confidential information by any root‑privileged application. The damage is limited to data confidentiality and does not involve denial of service or unauthorized code execution beyond the accessed data.

The flaw affects Apple macOS systems running any version prior to the macOS Tahoe 26 release. Apple macOS is the sole vendor listed, and the issue is present in all earlier builds until the entitlement checks introduced in macOS Tahoe 26 mitigate the risk.

The CVSS score of 6.2 indicates a moderate severity. The EPSS score of less than 1 % suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires a local root‑privileged app or the ability to execute code as root, meaning the attack vector is local. Because the flaw permits reads of private information but not broader system compromise, the overall risk is classified as moderate unless root access is widely distributed.