EUVD-2026-77959
GHSA-mcxv-5829-xp99
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector: a malicious app must run on the host (AV:L, UI:R); no prior auth beyond running the app (PR:N); confidentiality-only file read (C:H, I:N/A:N), matching the vendor vector.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A permissions issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An application may be able to access restricted files.
AnalysisAI
Improper path validation in Apple macOS allows a locally executing application to read files outside the scope it is authorized to access, resulting in disclosure of restricted data on affected systems. The issue affects macOS versions before 15.8 (Sequoia), before 26.7 (Tahoe), and before 27 (Golden Gate), and is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N); exploitation requires a malicious or compromised app to be running locally and relies on user interaction (AV:L/UI:R, PR:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker-controlled application to be executing locally on the target macOS system (AV:L) and requires user interaction to run/install that app (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) - Apple states the permissions issue is fixed in these releases, and the corresponding advisories are at https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today