The flaw arises from insufficient validation of symbolic links, allowing an application to create or follow a symlink that points outside its designated sandbox. When exploited, this can enable the application to access or manipulate files it should not be able to reach, potentially leading to unintended code execution or data disclosure. The weakness is mapped to CWE‑59: Improper Handling of Symbolic Links.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The fix is addressed in iOS 18.7.2 and 26.1, iPadOS 18.7.2 and 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1. Systems still on earlier releases are vulnerable.

The CVSS score of 6.3 indicates a moderate risk level. With an EPSS score of less than 1%, the likelihood of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a malicious symlink to the vulnerable application, and the impact is confined to the sandbox unless additional local privileges are obtained. Thus, while the potential impact on confidentiality, integrity, or availability is limited, the flaw still warrants timely remediation.