Technical impact
An attacker who already has root privileges on a macOS system can delete protected system files because the operating system assigns improper permissions during state management. This flaw allows removal of files that should be immutable, directly compromising system integrity and potentially leading to instability or service interruption.
Affected Systems
Apple macOS installations older than macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, or macOS Tahoe 26.4 are affected. The issue is fixed in those versions and later.
Risk and Exploitability
The CVSS score of 4.9 indicates moderate severity, and an EPSS score of under 1% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local root access; without that privilege the flaw cannot be leveraged, making remote exploitation unlikely. If an attacker gains root, they can delete critical system files, potentially causing system failure or requiring a costly recovery.
