This vulnerability is a downgrade flaw that allowed applications on Intel‑based Macs to bypass newer code‑signing restrictions, potentially enabling them to read user‑sensitive data. The flaw is tied to the CWE‑347 weakness, which concerns improper restriction of operations within real trusted functions. The primary consequence is unauthorized disclosure of confidential information from the affected system.

Apple macOS on Intel‑based machines is affected. The issue existed in earlier releases before the following updates: Sequoia 15.7.5, Sonoma 14.8.5, Tahoe 26.3, and Tahoe 26.4. Any version of macOS on Intel hardware before these releases may be vulnerable.

The CVSS score of 6.2 indicates a medium severity, and the EPSS of <1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires the attacker to deploy a downgrade‑capable application on the target system, implying a local or privileged context; no remote code execution path is documented.