Apple identified a consistency flaw in macOS state‑handling logic that represents an improper authorization (CWE‑269) and can be abused by an application to obtain root privileges on the affected system.

The vulnerability affects macOS installations older than Sequoia 15.7.7, Sonoma 14.8.7, and Tahoe 26.5 until the corresponding update is applied.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. It is not listed in the CISA KEV catalog. The most likely attack vector is local user‑level execution of a malicious application, as no network‑based attack path is documented.