Apple macOS EUVD-2026-104716

Exploitation requires a locally-installed, low-privileged application already executing on the macOS host (AV:L, PR:L); it cannot be triggered remotely or over a network, and no user interaction beyond running the malicious app is needed (UI:N). The attacker must therefore first achieve local code execution via a malicious or compromised app. Impact is limited to disclosure of sensitive network connection information (C:H, I:N, A:N) and does not allow modification or denial of service. Limiting factors: default macOS app sandboxing and code-signing/notarization reduce the likelihood of an arbitrary malicious app running, and the flaw is fixed in macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.

This is a genuine but low-urgency issue. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable information-disclosure flaw: an already-installed, low-privileged app can read sensitive network connection information with high confidentiality impact but no integrity or availability impact. All secondary signals align with low real-world priority: EPSS is 0.16% (5th percentile), there is no CISA KEV listing, no public exploit is referenced, and the CISA SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The signals are consistent rather than conflicting - a locally-scoped confidentiality leak that is not weaponizable and requires code already running on the host. The one caveat is that exploitation presupposes attacker-controlled code execution on the device (a malicious or compromised app), so this is best treated as a defense-in-depth/privilege-escalation-adjacent fix rather than a frontline remote threat. No key CVSS data is missing or self-contradictory.

A user installs a seemingly benign macOS app (e.g. from outside the App Store or a trojanized download) that runs with normal user privileges. Due to improper state management, the app queries OS network state and obtains sensitive network connection information it should not be able to see, which it can exfiltrate. No public proof-of-concept exploit is referenced in the available data, and local execution (AV:L) with low privileges (PR:L) is required.