This vulnerability stems from insufficient redaction of sensitive data in macOS, which allows an application running with root privileges to read private information that should otherwise be protected. The flaw is a classic example of a weak access control (CWE‑284). The impact is the potential breach of confidentiality for user data residing on the system.

Apple’s macOS is affected, specifically versions prior to the release of macOS Tahoe 26.3, which contains the necessary fix. Any build that does not include the 26.3 update may still expose private data to privileged applications.

The CVSS score of 4.4 indicates low to moderate severity, and the EPSS score of less than 1% implies a very low probability of exploitation. This vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires an attacker to obtain root privileges on the target machine; once achieved, the attacker could read data that should be confined to non‑privileged processes. The overall risk therefore is limited to environments where root access can be leveraged, but the potential exposure of sensitive information warrants timely remediation.