A malformed asset catalog can trigger improper memory handling in macOS, leading to the exposure of process memory contents. This information disclosure could allow an attacker to gain unauthorized access to sensitive data residing in memory. The vulnerability is an example of improper internal resource handling, where unvalidated input causes memory leaking. The primary impact is confidentiality compromise.

Apple macOS products are affected, specifically versions prior to macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. The vulnerable code path processes asset catalogs, which are used to bundle resources for applications. Users running these operating system releases are potentially exposed to memory disclosure if they process maliciously crafted catalogs.

With a CVSS score of 5.5, the vulnerability represents moderate severity. The EPSS score is below 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is delivery of a malicious asset catalog to macOS or a privileged application; exploitation requires the ability to supply a crafted catalog to the vulnerable code path. Once processed, memory contents may be read and extracted by the attacker. The risk remains moderate until a patch is applied.