A flaw in the file quarantine mechanism allows an application to bypass the intended restrictions and escape its sandbox, potentially gaining access to protected resources and user data. The weakness is an access‑control violation (CWE‑284). While the admission does not explicitly state the method of exploitation, it is inferred that an attacker could trigger the bypass by placing a specially crafted file within the quarantine area or by manipulating the quarantine logic while the target application is running.

Apple macOS versions prior to Sequoia 15.7, Sonoma 14.8, and Tahoe 26 are affected. Users running these older releases should identify whether their current operating system falls within these ranges.

The CVSS score of 5.2 indicates a moderate severity. The EPSS score of < 1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Given the nature of the flaw, the most probable attack vector is local, requiring the attacker to be able to influence the target application’s execution of files subject to quarantine checks.