What is the CVSS score of CVE-2026-28830?

CVE-2026-28830 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-28830?

Yes, a patch is available for CVE-2026-28830. Update the affected software to the latest version immediately.

Apple macOS CVE-2026-28830

EUVD-2026-29216 MEDIUM

Race Condition (CWE-362)

2026-05-11 apple

GHSA-m8rh-94h3-qvh3

Information Disclosure Apple Race Condition

4.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.7 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

4.7 MEDIUM

Local-only exploitation via a race condition (AC:H), no elevated privileges required, user must run the app (UI:R), confidentiality-only impact with no integrity or availability consequence.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:42 vuln.today

CVSS changed

May 12, 2026 - 19:22 NVD

4.7 (MEDIUM)

Patch available

May 11, 2026 - 22:03 EUVD

CVE Published

May 11, 2026 - 20:07 nvd

MEDIUM 4.7

CVE Published

May 11, 2026 - 20:07 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.

AnalysisAI

Race condition in Apple macOS (all versions before Tahoe 26.4) allows a locally-executing app to win a timing window during a validation step and access sensitive user data it should not be permitted to read. The vulnerability carries a CVSS base score of 4.7 (Medium) reflecting local attack vector, high complexity, and a confidentiality-only impact. No public exploit code exists and no active exploitation has been confirmed; EPSS places exploitation probability at 0.02% (5th percentile), consistent with the CISA SSVC assessment of exploitation status 'none'.

Technical ContextAI

CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization, commonly called a race condition or TOCTOU flaw) describes a class of bugs where two or more concurrent operations access a shared resource without proper locking or sequencing guarantees, allowing an attacker to manipulate state between a check and a use. In this case, an application running under macOS can race against a validation routine to read sensitive user data before the OS enforces access controls. The affected product is identified by CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, covering all macOS releases prior to Tahoe 26.4. Apple addressed the root cause with 'additional validation,' which typically means introducing a check-then-act sequence that is atomic or mutex-protected to close the race window.

RemediationAI

Upgrade to macOS Tahoe 26.4, which contains Apple's fix (additional validation to close the race window). The vendor-released patch is confirmed via the Apple security advisory at https://support.apple.com/en-us/126794. No workarounds are documented by the vendor for this specific race condition. As a compensating control where immediate upgrade is not possible, restricting the installation and execution of untrusted third-party applications via macOS Gatekeeper policies or MDM profiles reduces the attack surface, since exploitation requires a malicious app to execute locally; note this does not eliminate the vulnerability but raises the barrier for an attacker to deliver the malicious app.