A parsing issue in the handling of directory paths can allow an application to read files outside its intended scope. The vulnerability is triggered by insufficient path validation and can expose sensitive user data such as personal documents or system configuration files. The weakness is a classic path traversal flaw (CWE‑22).

Apple macOS systems running versions prior to the macOS Tahoe 26.3 release are affected. The patch that remediates the issue is provided in macOS Tahoe 26.3 and later releases.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1 percent shows a very low current exploitation probability. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the likely attack vector is local execution by a malicious application that a user has installed, rather than a remote attacker. Successful exploitation would allow that application to read otherwise protected files, compromising confidentiality.