The vulnerability arises from insufficient validation of symbolic links, allowing an application to resolve links that point to protected files. This flaw, identified as CWE‑59, can enable an attacker to read or manipulate data that should be restricted, undermining confidentiality and integrity of user information.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS prior to the release of version 26.1 on iOS/iPadOS, tvOS, visionOS, and watchOS, and before Sequoia 15.7.2, Sonoma 14.8.2, and Tahoe 26.1 on macOS are affected. All variants of each OS not yet updated to those specific releases are vulnerable.

The CVE description indicates that a malicious application could use the symlink validation weakness to read protected data. However, the CVE does not detail the conditions under which this could occur, such as required permissions or application context. Therefore it is unclear whether local or remote execution is necessary. It is inferred that the vulnerability would be exploitable by an app that can create or manipulate symbolic links within its sandbox. The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% implies a low likelihood of exploitation under current conditions. The vulnerability is not listed in CISA KEV, suggesting no documented active exploits.