Apple reported a privacy flaw involving improper handling of temporary files, which allows a malicious application to read data that should remain confidential. The weakness is classified as CWE‑377, reflecting inadequate protection of temporary data. If exploited, an attacker could gain unauthorized access to user information stored in these temporary locations, potentially leading to privacy leaks without affecting system integrity or availability.

The vulnerability impacts macOS across all releases older than macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, and macOS Tahoe 26.3. Users running any of those older versions are at risk until they upgrade to a fixed release.

The CVSS score of 6.2 indicates a moderate severity, while an EPSS score below 1 % suggests low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a local application that can access the temporary file system, implying that attackers need to run code on the affected device or trick users into opening a malicious app.