The vulnerability is a path parsing issue in macOS’s directory handling. It arises when the system fails to correctly validate directory paths supplied by an application, allowing the app to reference files outside its intended scope. This flaw, identified as CWE‑22, could enable the application to read sensitive user data stored in protected locations, thereby causing potential data exposure. Because the flaw exists in the path validation logic rather than in authentication, any application that can run on the system has the opportunity to exploit it.

Apple macOS firmware, specifically versions before Sequoia 15.7.2, Sonoma 14.8.2, and Tahoe 26.1. The issue was resolved in these releases, so devices running older builds may remain vulnerable.

The CVSS score of 5.5 classifies it as a medium impact vulnerability. The EPSS score of less than 1% indicates a very low probability that attackers have already crafted or deployed exploits against it. Because the attack vector relies on a local application that can supply a malicious path, the exploitation window is limited to systems where an attacker can install or run a custom application. The anomaly is not recorded in the CISA KEV catalog, underscoring that widespread exploitation has not been observed.