An injection issue in macOS arose from insufficient input validation, permitting an application to read sensitive user data. The weakness is identified as CWE-95, and the fix involves improved validation. The vulnerability does not lead to arbitrary code execution or denial of service, but it potentially exposes private information.

Apple macOS installations prior to macOS Tahoe 26.1 are affected. Versions newer than or equal to 26.1 contain the remediation.

Based on the description, it is inferred that an attacker would need to trigger the injection through a local application; remote exploitation is not indicated. The CVSS score of 3.3 reflects a low overall risk, and the EPSS score of < 1% suggests that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, further indicating limited observed exploitation. Consequently, the threat to general users remains low.