Technical impact
A race condition in macOS may permit an application to read user data that should otherwise be inaccessible. The flaw originates from state handling that fails to serialize concurrent operations correctly, allowing sensitive data to be accessed via a timing exploit. Attackers could obtain personal or confidential information if the condition is triggered.
Affected Systems
Apple macOS versions prior to Sequoia 15.7.2, Sonoma 14.8.2, and Tahoe 26.1 are affected. All earlier releases in these macOS families remain vulnerable, while updated releases implement improved state handling that resolves the race condition.
Risk and Exploitability
The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of <1% suggests a very low likelihood of real‑world exploitation. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is local, requiring an application with elevated privileges or a user‑injected timing attack to trigger the race condition.
