A parsing issue in directory path handling caused inadequate validation and allowed applications to access files and directories beyond their intended scope. The flaw is a classic directory traversal weakness, classified as CWE‑22, that may enable an attacker to read or otherwise interact with sensitive user data. The vulnerability was fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, and visionOS 26.3 through improved path‑validation logic.

The affected vendors are Apple, impacting macOS and visionOS. Specific product versions lacking the fix include all releases of macOS Sequoia, Sonoma, and Tahoe prior to 15.7.4, 14.8.4, and 26.3 respectively, as well as visionOS versions prior to 26.3.

The CVSS score of 5.5 places the issue in the medium severity range, and the EPSS score of less than 1 % indicates a very low probability of exploitation at the time of this analysis. It is not listed in CISA’s KEV catalog, reflecting a low or no documented exploitation. The likely attack vector is local; an application—whether malicious or compromised—may abuse the flaw to read protected user files. No remote exploitation path is explicitly documented. The weakness’s nature limits impact to data confidentiality within the local system context, but any compromise of user data can have significant privacy implications.