An app may delete files for which it does not have permission, violating proper access controls and allowing a non‑privileged app to compromise data integrity and availability.

Apple devices running iOS or iPadOS 26.6 or later, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, or visionOS 26.6 are protected by the fix. Devices on earlier releases remain vulnerable. No specific third‑party software is cited, so the issue targets the operating systems themselves.

The EPSS score is < 1%, indicating a low but non‑zero exploitation likelihood, and the CVE is not listed in the CISA KEV catalog. The flaw is an improper access control weakness; an attacker whose app can execute code on the device (e.g., through user‑installed software) could delete protected files. The likely attack vector is a local or user‑initiated one where the attacker supplies or installs a malicious app that gains elevated privileges within the Apple ecosystem. Based on the description, the vulnerability allows denial of service and data modification to files the app should not access.