This vulnerability stems from a previously existing code section that has been removed to address the issue. It permits an installed application to read protected user data, which is a breach of access-control boundaries, as identified by CWE-284. The impact is the unauthorized disclosure or possible modification of sensitive information. The vulnerability does not provide direct execution or denial of service capabilities, but it does enable data leakage.

Apple macOS systems are affected. The issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26. Versions prior to these releases may remain vulnerable, though the exact pre-patch version range is not specified in the available data.

With a CVSS score of 5.5 the vulnerability is considered moderate, and the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. It is not listed in CISA's KEV catalog. No remote exploit vector is explicitly documented; the description suggests that a local or user-level application could leverage the flaw. The risk largely depends on the presence of trusted third-party apps that could read protected data without authorization.