A logic issue in macOS may allow a malicious application to break out of its sandbox; improved restrictions were introduced in later releases, but prior to macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4 the flaw existed. By exploiting this flaw, an attacker could gain unauthorized access to system resources, potentially compromising confidentiality and integrity of data. The weakness relates to improper access control within the operating system sandboxing model.

Apple macOS versions preceding macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, or macOS Tahoe 26.4 are vulnerable. The issue was addressed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4 and later revisions. Users running earlier releases are at risk.

The CVSS score of 4.0 indicates moderate severity, but the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability was not reported in the CISA KEV catalog. Based on the description, the likely attack vector involves a locally running malicious application that attempts to bypass sandbox limits; this inference is drawn from the mention of a sandbox escape scenario.