A parsing issue in the handling of directory paths was reported for multiple Apple operating systems. The vulnerability may allow an application to access sensitive user data. The weakness aligns with a classic path‑traversal flaw (CWE‑22), inferred from the nature of the directory path parsing problem stated in the advisory.

iOS releases 18.7.5 and 26.3, iPadOS releases 18.7.5 and 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, and visionOS 26.3 are vulnerable. Devices running versions older than these lists are affected.

The CVSS score of 5.5 indicates moderate potential impact, and the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying that no widespread exploitation has been observed. Based on the description, it is inferred that an attacker could exploit this issue by delivering or running a malicious application in a context that the system trusts; the application could then traverse directories and read files that should be out of reach. Because the flaw does not provide remote code execution or privilege escalation, the risk is confined to applications already permitted to run on the device.