Technical impact
A permissions defect caused the USB Restricted Mode feature to be ignored for accessories that are connected to a macOS system before the operating system starts. The result is that devices attached during the pre‑OS phase can interact with the machine without the intended security restrictions. This represents an improper access control flaw, as the system fails to enforce the constraints that the mode is supposed to provide. The official description does not confirm escalation of privileges or arbitrary code execution, but the condition could allow an attacker to insert a malicious accessory that operates before boot security measures are applied.
Affected Systems
Apple macOS installations running a version earlier than macOS Tahoe 26 are vulnerable. The vulnerability was fixed in macOS Tahoe 26; any older releases remain susceptible.
Risk and Exploitability
The CVSS score of 5.1 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale exploitation campaigns. Because the fault is triggered by a USB device connected prior to boot, attackers would need physical access to the machine before it starts, which limits the threat to environments where such access is possible.
EUVD