A parsing issue in the handling of directory paths was identified in macOS. The flaw allows an application to potentially access sensitive user data by providing crafted directory paths. The weakness is a path traversal vulnerability (CWE‑22). The impact is the compromise of data confidentiality for users running affected software, but it does not affect system integrity or availability.

Apple's macOS operating system, specifically versions prior to macOS Tahoe 26.1, are affected. The issue is fixed in macOS Tahoe 26.1 and later. Any application running on these systems that fails to validate path inputs correctly could exploit the flaw.

The CVSS score of 3.3 indicates low severity, and the EPSS score of less than 1 % suggests a very low likelihood of exploitation. The flaw is not listed in CISA's KEV catalog, further implying that active exploitation is unlikely and likely limited to apps that intentionally provide malformed paths. The attack vector is inferred to be local or within an application context; an attacker would need to influence the application's path handling, which is mostly mitigated by macOS sandboxing and application signing.