A permissions flaw allows a standard user to view files created from a disk image that belongs to an administrator. The issue is due to insufficient restriction of read access to those files, leading to disclosure of potentially sensitive data. The weakness corresponds to improper permission controls, represented by CWE-732.

Apple macOS is affected. Systems running macOS Tahoe before version 26.1 contain the vulnerability. Updating to macOS Tahoe 26.1 or later resolves the issue by adding the necessary restrictions.

The CVSS score of 5.5 reflects a moderate impact. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local, with a standard user leveraging a mounted disk image to gain unauthorized read access to administrator files. In the absence of additional mitigations, the vulnerability could result in information disclosure but not more severe damage such as elevation of privilege or code execution.