Technical impact
A race condition in the operating system's state handling permits an application to obtain root privileges, creating a full system compromise. The flaw is identified as a concurrency error (CWE‑362) and enables the attacker to gain complete control over the device, potentially allowing data theft, persistence, or further exploitation. The vulnerability is not a denial‑of‑service issue but a direct elevation of privilege that can be used to subvert security controls.
Affected Systems
Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS could be affected. The issue is fixed in iOS 26.3, iPadOS 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3. Versions prior to those must be treated as vulnerable.
Risk and Exploitability
The CVSS base score of 7.0 indicates high severity, but the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, signifying a low likelihood of widespread exploitation. Attackers would need to trigger the race condition, which typically requires interaction with a malicious app – this attack vector is inferred from the description. Once the race is triggered, the impact is complete system compromise. The vulnerability can be exploited through normal app execution, again an inference based on the wording, making it a significant threat that deserves timely mitigation.
