The vulnerability is a permissions issue that bypasses sandbox restrictions, allowing an application to read sensitive user data. The flaw is a weak access control defect. Because the sandbox is insufficiently enforced, an attacker can cause a local data disclosure without elevated privileges. The impact is limited to the sandboxed application and the data it can access, but it still compromises confidential user information.

This flaw affects Apple macOS Tahoe releases prior to version 26.1. Users running any macOS Tahoe build before 26.1 are potentially vulnerable. The issue is present across all applications that rely on the affected sandbox configuration.

The CVSS score of 3.3 indicates low overall severity, and the EPSS score of less than 1% suggests an extremely low probability of exploitation. The vulnerability is not listed in CISA KEV. The flaw relies on local sandbox permissions and would require an application to be executed on the system. Based on the description, the likely attack vector is a malicious or compromised application run locally. No remote exploitation path is explicitly described.