An out‑of‑bounds read vulnerability in macOS allows an application to read memory past intended bounds, potentially exposing sensitive user data. The flaw is addressed by improved bounds checking in updated releases, but before the fix it could be leveraged to breach confidentiality. The weakness is a classic buffer overread, mapped to CWE‑787, and could be exploited by any app that runs with sufficient privileges to trigger the fault.

Apple’s macOS releases prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 are vulnerable. Any Mac running an earlier OS version, regardless of edition, contains the flaw until it receives one of the specified patched updates.

The CVSS score of 5.5 indicates a moderate impact, while the EPSS score of less than 1 % suggests a very low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector is not explicitly documented, the most likely scenario is a local or application‑based exploit that reads privileged memory, exposing user data. Prompt patching mitigates the confidentiality risk.