This vulnerability arises from insufficient validation of symbolic links in macOS. The flaw allows any application to read files that it normally could not access, such as protected user data, leveraging the improper handling of symlinks. The weakness maps to CWE‑59, which describes absolute path traversal via symlink manipulation. The potential impact is a confidentiality breach where sensitive files become readable by malicious or compromised applications.

Apple macOS is affected. The issue is fixed in macOS Tahoe version 26.1. All earlier releases lacking the patch are potentially vulnerable, including any macOS build prior to that point.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is below 1%, representing a low probability of exploitation at present, and the vulnerability has not been reported in the CISA KEV catalog. The likely attack vector is local, requiring an app to be executed on the vulnerable machine; no remote exploitation is indicated by the current description. The combination of moderate risk and low exploitation probability suggests that patching is prudent but the threat level is manageable for today.