Technical impact
The vulnerability is a permissions issue that allows an application to access sensitive user data without proper restriction. This flaw enables data disclosure, exposing private information to apps that should not have such access. The weakness is classified as CWE-200, which highlights inadequate protection of information.
Affected Systems
This issue affects Apple macOS installations, specifically versions that are not updated to macOS Sequoia 15.7.2 or macOS Tahoe 26.1. Users running earlier macOS releases may experience the unauthorized data access.
Risk and Exploitability
The CVSS score of 5.5 categorizes this vulnerability as moderate severity. The EPSS score indicates a very low exploitation probability (less than 1%), and it is not listed in the CISA KEV catalog. The likely attack vector is local, inferred from the description that an installed application may read user data, but no explicit remote attack path is provided in the information. The vulnerability is best understood as an elevated local permission issue, and exploitation would typically require the presence of a malicious or misconfigured third‑party application. The risk to users is therefore moderate, with a low probability of exploitation and no known widespread attacks.
