A path handling issue was identified in macOS that permits a malicious or compromised application to observe unprotected user data. The flaw arises from insufficient validation of file system paths, which enables information disclosure and corresponds to an unauthorized access vulnerability (CWE‑552).

Apple macOS is affected. Versions of macOS Sequoia earlier than 15.7.7, macOS Sonoma earlier than 14.8.7, and macOS Tahoe earlier than 26.5 are vulnerable. The issue was mitigated in the releases mentioned in the advisory.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker could leverage this flaw from any application that can access the file system, typically on the same local workstation. The risk remains primarily local, affecting the confidentiality of sensitive files accessible to the user or applications with user privileges.