Technical impact
Based on the description, it is inferred that a race condition in macOS Tahoe allows a malicious or compromised application to read sensitive user information that should otherwise be protected. The issue is resolved by adding validation checks that prevent the timing flaw from granting unauthorized data access. It is inferred that the vulnerability could lead to a confidentiality breach if an attacker can execute an arbitrary app with sufficient local privileges.
Affected Systems
The vulnerability affects Apple macOS Tahoe versions released before 26.4. The fix is available in macOS Tahoe 26.4, and any earlier releases remain susceptible to the race condition if not patched.
Risk and Exploitability
The EPSS score is reported as less than 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no publicly exploited incidents are known. The CVSS score of 4.7 indicates medium severity. It is inferred that a race condition that allows data disclosure poses a significant risk if an attacker can execute a malicious application locally. It is inferred that the low EPSS combined with the medium CVSS suggests the vulnerability is unlikely to be widely exploited, but the potential for confidentiality compromise warrants timely remediation.
