A path handling issue caused by insufficient validation can allow an application to elevate its privileges to the root level. The weakness is a classic path traversal vulnerability (CWE-22), which threatens confidentiality, integrity, and availability by enabling an attacker to access or modify system files and settings they normally cannot reach. The vulnerability was identified in multiple Apple operating systems and approved fixes now provide stricter path validation. The potential impact amounts to full system compromise if exploited.

Apple products are affected including iOS and iPadOS, macOS Sequoia (15.7.8), macOS Sonoma (14.8.8) and macOS Tahoe (26.6), as well as tvOS, visionOS, and watchOS all at version 26.6. The CVE notes that each of these platforms has a patch in the corresponding 26.6 or 15.7.8/14.8.8 releases, indicating that older builds are vulnerable.

The CVSS score of 7.8 signals a high severity risk, and the EPSS score of <1% indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly confirmed exploits yet. Based on the description, the likely attack vector is a local or application-level exploitation where a malicious app supplies a crafted path to the OS, bypassing validation checks. An attacker would need to be able to install or run a malicious application on the device, and then trigger the vulnerable path handling to gain root privileges.