The vulnerability is caused by improper state management that permits an attacker to alter the state of the macOS Keychain. This can lead to unauthorized changes to stored credentials, resulting in possible credential theft or misuse. The flaw aligns with access control weaknesses (CWE‑284) and race condition problems (CWE‑362).

Apple macOS is affected. Versions prior to macOS Tahoe 26.6 contain the flaw; the update 26.6 includes the fix. All earlier releases without the update are considered vulnerable. The exact version range before 26.6 is not enumerated, so any macOS version below 26.6 should be regarded as at risk.

The CVSS score is 7.5, indicating a high severity risk. The EPSS score is less than 1 %, implying a low probability of exploitation in the near term. The vulnerability is not listed in CISA KEV. Attackers could exploit it via local or privilege‑escalation mechanisms to modify Keychain entries. While no public exploit is known, the potential impact on credential confidentiality warrants proactive mitigation.