Apple iOS, iPadOS, macOS, and visionOS have a race condition in symbolic link handling that can be exploited through a crafted shortcut. The flaw allows the shortcut to bypass sandbox restrictions, enabling an attacker to access data or resources normally confined to the sandbox. The vulnerability aligns with concurrency weaknesses (CWE-362, CWE-367) and can compromise confidentiality, integrity, and availability by elevating access privileges for the affected process.

The affected products include Apple iOS and iPadOS, Apple macOS, and Apple visionOS. Versions impacted are iOS 18.7.5 and iOS 26.3, iPadOS 18.7.5 and iPadOS 26.3, macOS Sonoma 14.8.4 and macOS Tahoe 26.3, and visionOS 26.3. The vulnerabilities are fixed in the respective major releases listed above.

With a CVSS score of 9, this flaw is considered critical. The EPSS score is less than 1 %, indicating a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Because the attack vector is inferred to be local or user‑initiated through a shortcut, the likelihood of successful exploitation remains low, but once an attacker gains the ability to trigger the race condition, the impact is severe.