An injection issue in macOS was resolved by adding improved input validation. The flaw allows a local application to manipulate data that is normally protected, giving the app the ability to read or write sensitive user information. The vulnerability’s root cause is a user‑controlled injection (CWE-863).

The affected products are Apple macOS. Vulnerable releases include earlier versions of macOS Sequoia, Sonoma, and Tahoe. The issue was fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.3. Systems running these releases or earlier should be considered at risk.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is reported as < 1%, meaning the contemporary probability of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw involves local app input, the likely attack vector is a local attacker who can supply malicious input or install a compromised app. The vulnerability could be used to read sensitive data but does not provide remote code execution or denial of service.