What is the CVSS score of CVE-2026-28834?

CVE-2026-28834 has a CVSS 3.1 base score of 5.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28834?

Organizations using A race condition should be aware of moderate risk from CVE-2026-28834, a race condition vulnerability rated CVSS 5.1.. A patch is available.

How to fix or mitigate CVE-2026-28834?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28834

EUVD-2026-15105 MEDIUM

Race Condition (CWE-362)

2026-03-25 apple

GHSA-552g-3pcr-rj34

Apple Race Condition Information Disclosure macOS

5.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

15.7.5,14.8.5,26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15105

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.1

DescriptionCVE.org

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to cause unexpected system termination.

AnalysisAI

macOS systems running Sequoia 15.7.4 and earlier, Sonoma 14.8.4 and earlier, or Tahoe 26.3 and earlier are vulnerable to a race condition in application state handling that allows local attackers to trigger unexpected system termination and cause denial of service. The vulnerability requires specific timing conditions but does not require user interaction or elevated privileges to exploit. Apple has released patches for affected versions, though exploitation likelihood remains low.

Technical ContextAI

This vulnerability is rooted in a race condition (CWE class: improper synchronization or state management) within macOS kernel-level or system service components. Race conditions occur when multiple execution threads access shared resources without proper synchronization, leading to unpredictable state transitions. The affected CPE (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) indicates the vulnerability resides in the core macOS operating system rather than a discrete application. The 'improved state handling' language in the fix description suggests Apple addressed the race condition by implementing additional locking mechanisms, atomic operations, or state validation routines to prevent concurrent execution paths from corrupting critical system state. The ability for any app to trigger system termination implies the vulnerable code path is accessible from user-level application contexts, making this a local privilege escalation or denial-of-service vector.

RemediationAI

Users should immediately upgrade to macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, or macOS Tahoe 26.4, whichever is applicable to their system. Navigate to System Settings > General > Software Update and install the latest available patch; Apple will deploy these updates automatically for most users within days of release. For organizations managing multiple macOS systems, use Mobile Device Management (MDM) platforms such as Jamf Pro, Apple Business Manager, or Intune to enforce mandatory installation of these patches across all enrolled devices. Until patches can be deployed, limit user application execution to trusted applications from the App Store (which have sandboxing enforcement) and disable sideloading of unsigned applications where organizational policy permits. Monitor https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for patch availability confirmation and any revised guidance from Apple.