A flaw in the way macOS processes symbolic links can allow a malicious application to remove data that should be protected. The vulnerability is a classic example of CWE‑59, which involves unsafe relative path resolution. An attacker who can run or trick a user into installing a malicious app can use the improper symlink handling to target files that the system otherwise considers secure, resulting in data loss.

Apple macOS is affected by this issue. The vulnerability exists in all releases prior to macOS Tahoe 26.1, which contains the fix. No specific sub‑versions are listed, so any macOS build before 26.1 is potentially vulnerable.

The CVSS score of 5.5 indicates moderate impact. The EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be local: a malicious application or user script that runs with the user’s privileges must gain access to the operating system to abuse the symlink handling. No network‑based exploitation is described in the provided data.