A parsing issue in the handling of directory paths was fixed with improved path validation. The flaw, identified as CWE-22, can allow an application to resolve paths to locations outside the intended directory, thereby accessing sensitive user data. The vulnerability is not described as enabling execution or other higher‑level attacks; it primarily risks unintended data disclosure.

Apple macOS is affected. The issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3 and macOS Tahoe 26.1. Earlier releases of these operating systems remain vulnerable.

The CVSS score of 5.5 indicates a moderate risk. The EPSS score of less than 1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; a malicious or compromised application could take advantage of the path validation bug to access files the user might not intend it to read.