An injection flaw in macOS allows an application to read sensitive user data that it should not be able to access. The vulnerability is categorized as a Command Injection (CWE-95) and is mitigated through enhanced input validation in the patched build. If exploited, an attacker could gain local access to confidential files or personal information, undermining the confidentiality of the affected user’s system.

Apple’s macOS platform is impacted, specifically versions released before the 26.1 update of the macOS Tahoe release. The fix is embedded in macOS Tahoe 26.1, meaning all earlier builds of this release are vulnerable. User systems running any pre‑26.1 macOS through an independent channel, such as OTA updates or device imagery lacking the patch, will remain at risk until they are upgraded.

The reported CVSS score of 5.5 denotes a moderate risk, and the EPSS score of less than 1% suggests a low probability of current active exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of the flaw, the attack vector is most likely local—the exploiter needs to execute a malicious application or inject data via a local application that can trigger the command by leveraging the validation weakness. No remote code execution or external network-based exploitation is indicated by the available data.