Improper validation of symbolic links in the operating system allows an application to maliciously reference protected files. This vulnerability can be exploited to read or write data that should be confined to the system or other users, leading to unauthorized access to sensitive user information. It represents a path traversal issue tied to the CWE-59 weakness.

Apple’s operating systems—iOS, iPadOS, and macOS—are affected. Vulnerable versions include any releases before iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4. The issue is resolved in the listed patch versions.

The CVSS score of 6.2 denotes medium severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited real-world exploitation. Attack vectors are most likely local, requiring the use of a malicious or compromised application to supply forged symlink paths; the need for local code execution reduces the risk of widespread remote attacks. Overall, the risk remains moderate but does not pose an immediate large-scale threat.