An authorized user of Microsoft Defender for Endpoint on macOS can locally access sensitive personal data that should remain private. The vulnerability is a local information disclosure, classified as CWE-359, allowing an attacker with legitimate Defender privileges to reveal confidential information.

Microsoft Defender for Endpoint for Mac from Microsoft. No specific affected product versions are listed in the available data.

The CVSS score of 4.7 indicates a moderate severity level, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Because the attack requires an authorized local user with Defender access, the likely attack vector is local exploitation rather than network-based.