The vulnerability is a path‑parsing flaw that lets a malicious app break out of its sandbox, potentially allowing it to access system resources, read or modify protected data, or execute arbitrary code. It represents a classic path traversal weakness that undermines the integrity and confidentiality guarantees provided by the platform's sandboxing model.

Apple operating systems are affected, including iOS and iPadOS prior to version 26.6, macOS versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and tvOS prior to 26.6. The advisory lists the exact versions that contain the fix, so any device running an older release remains vulnerable.

The flaw permits sandbox escape, a high‑impact attack that requires the attacker to install a malicious application on the device. With access to the local filesystem and process space, the attacker could gain persistent, elevated privileges. The EPSS score of < 1% suggests a low probability of exploitation, and since it is not listed in the CISA KEV catalog, the primary risk assessment is based on the CVSS score of 9.3, which indicates a serious threat. Updating to the fixed versions eliminates the attack surface.