A permissions flaw in Apple macOS allows certain applications to read protected user data that should otherwise be inaccessible. The weakness arises from insufficient access controls, enabling an app with the wrong privileges to bypass normal safeguards. Because the flaw directly compromises data confidentiality, an attacker could view or exfiltrate sensitive information.

Apple macOS operating systems are impacted. The fix has been applied in macOS Tahoe 26.5. All earlier releases without the patch are vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of public exploitation. However, the flaw's nature - granting an app the ability to access protected data - presents a significant confidentiality risk if exploited. The attack vector is likely local, requiring the attacker to install or execute an application on the affected system that exploits the permission lapse. The impact is system-wide for the compromised account, and the severity would rise if the affected application processes data written to untrusted locations.