The vulnerability arises from insufficient validation of symbolic links during file system operations. An application that follows a symlink pointing to a protected file can unintentionally read data that should remain confidential, effectively exposing protected user information. The flaw represents an improper access control issue that further relies on the lack of proper input validation for symbolic link paths.

Apple macOS is affected; the issue exists in all macOS Sequoia releases prior to 15.4. The flaw was addressed in macOS Sequoia 15.4 and later.

The CVSS score is 5.5; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need local execution privileges to create or control a symbolic link that points to sensitive data, indicating the problem is local with no documented remote exploitation path. Thus, the likelihood of exploitation is limited to scenarios where an app can write to a directory that may contain a symlink to protected files.