A race condition exists in Apple iOS and iPadOS that allows an application to modify protected file system components. The flaw arises from timing gaps in security checks that evaluate file system integrity, enabling an attacker to replace or tamper with critical system files or other privileged resources. This corruption of system state could compromise integrity, facilitate persistence, or allow the execution of malicious code with elevated privileges.

Apple iOS and iPadOS devices running versions prior to iOS 26.6 and iPadOS 26.6 are affected. The fix was introduced in iOS 26.6 and iPadOS 26.6, so any device with an older firmware remains vulnerable to this race condition.

The CVSS score of 4.7 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but it still permits modification of protected file system areas, which could be leveraged for privilege escalation if an attacker gains sufficient local or application-level access. The risk remains limited to devices operating on older iOS or iPadOS releases pending the application of the patch.