A parsing flaw in macOS's handling of directory paths can allow a malicious application to bypass normal path checks, potentially enabling the app to write or execute files with elevated privileges. The result is a root privilege escalation risk, giving the attacker complete control over the affected system. This weakness is a classic example of improper path validation, classified as CWE-22.

Apple macOS is affected. Versions earlier than macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5 are potentially vulnerable. These update releases include the necessary path‑validation fix.

The CVSS score is 7.8 and the EPSS score is less than 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description the attack is likely local, requiring the attacker to run a malicious or compromised application. If exploited, the attacker could gain root privileges and thus full system control.