The vulnerability is a parsing flaw in how macOS validates directory paths when processing certain requests. This flaw can allow a malicious application to bypass normal path restrictions and read files outside its intended directory, potentially exposing confidential user data. The weakness is a permissive access control flaw, categorized as CWE‑284.

The issue affects Apple macOS operating systems up to and including macOS Tahoe 26.3. Apple recommends updating to macOS 26.4 where the path validation has been hardened.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1 %, implying low likelihood of widespread exploitation, and it is not currently listed in the CISA KEV catalog. The flaw can be exploited by any application that can be compelled to process a crafted directory path, which means an attacker could potentially gain read access to arbitrary files on the affected device.