A parsing issue was discovered in macOS’s handling of directory paths. The flaw allows an application to validate and parse paths incorrectly, potentially permitting an attacker to break out of the application’s sandbox. This results in an elevation of privilege, allowing the malicious code to execute outside the intended restricted environment. The weakness is categorised as a classic directory traversal / path manipulation flaw and is listed as CWE‑22.

The vulnerability affects Apple macOS systems. Although the exact vulnerable versions are not enumerated, the advisory indicates that recent updates – Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 – contain the fix. Consequently, earlier releases of these macOS lines that have not applied the patch are potentially at risk.

The CVSS score of 9.3 classifies the deficiency as critical, signalling severe impact if exploited. However, the EPSS score of less than 1 % suggests a very low probability of active attack within the near term, and the flaw is not currently listed in the CISA KEV catalog. The likely attack vector involves a malicious or compromised application running locally; an attacker would need to supply or influence the path parsing to achieve sandbox escape. Given the high severity, administrators should treat this as a priority patching item.