Technical impact
A race condition related to state handling was identified in macOS. The flaw allows an application to read sensitive user data that it should not be able to access. The vulnerability is classified as CWE‑362, indicating a competing resource usage issue that can result in data leakage. No evidence of remote execution or privilege escalation is provided, and the impact is limited to disclosure of user data rather than system compromise.
Affected Systems
The affected products are Apple macOS, specifically Sequoia 15.7, Sequoia 15.7.2, and Tahoe 26. No other Apple operating system versions are listed as vulnerable in the current advisory. Users running these releases should verify their version through System Settings or terminal.
Risk and Exploitability
The CVSS score of 5.5 places this issue in the medium severity range. The EPSS score of less than 1% indicates that the chance of exploitation in the wild is very low, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is inferred to be local execution, requiring the attacker to run or influence a privileged application on the target machine. If an attacker can trigger the race condition from a user‑level app, they could read confidential data, but no evidence suggests the flaw can be leveraged for further privilege escalation.
EUVD