An application on macOS can exploit improper handling of symbolic links to read files that it should not normally access, potentially exposing user‑sensitive data. The weakness stems from incorrect path resolution, categorized as a path traversal vulnerability (CWE‑59). If an attacker can direct the application to follow a crafted symlink, the app may retrieve confidential information that resides outside its intended directory.

Apple's macOS operating system is affected. Versions of macOS prior to the security update—specifically before macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4—are vulnerable. The issue applies broadly to the standard macOS installation and any third‑party applications that rely on the system's symbolic link handling.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker with the ability to install or run an application on the victim's machine could craft symlinks to access protected files. No public exploit has been identified, but the moderate score means that applying the available update is prudent.