The vulnerability is a race condition (CWE-362) that allows a malicious application to bypass macOS privacy preference checks. The description indicates that a malicious application may be able to bypass privacy preferences, which could enable the application to access data or settings that should otherwise be protected by the operating system’s privacy controls. Based on this, bypassing privacy preferences could allow the application to access protected data or alter system settings; this inference is not explicitly stated in the description.

Apple macOS installations running before the releases that include the fix are impacted. The issue is mitigated in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Devices on earlier versions of these macOS releases are vulnerable.

The CVSS score of 4.7 indicates a medium severity issue. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local execution of a malicious application, inferred from the text that a malicious application may bypass privacy preferences. Updating to a patched macOS version removes the race condition and restores proper privacy enforcement.