What is the CVSS score of CVE-2026-28888?

CVE-2026-28888 has a CVSS 3.1 base score of 5.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28888?

Organizations using A race condition should be aware of moderate risk from CVE-2026-28888, a race condition vulnerability rated CVSS 5.1.. A patch is available.

How to fix or mitigate CVE-2026-28888?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28888

EUVD-2026-15166 MEDIUM

Race Condition (CWE-362)

2026-03-25 apple

GHSA-8862-4xwm-p4pp

Apple Race Condition Information Disclosure macOS

5.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,26.4,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15166

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

MEDIUM 5.1

DescriptionCVE.org

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain root privileges.

AnalysisAI

macOS systems running Sequoia 15.7.4 and earlier, Sonoma 14.8.4 and earlier, and Tahoe 26.3 and earlier contain a race condition in state handling that allows local applications to escalate privileges to root. The vulnerability stems from improper synchronization during critical operations, enabling an attacker with local access to exploit the timing window and gain elevated system privileges. Patches have been released for affected macOS versions.

Technical ContextAI

The vulnerability is rooted in a race condition (CWE class issues) within macOS kernel or system-level state management. Race conditions occur when multiple processes attempt to access and modify shared resources without proper synchronization, creating a window where an attacker can manipulate system state between the check and use of a privileged resource. The affected products are identified via CPE as Apple macOS across multiple versions (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), indicating the vulnerability exists in the core operating system rather than a discrete application. Apple's fix through improved state handling suggests additional locking mechanisms, atomic operations, or ordering constraints were implemented to eliminate the race condition window.

RemediationAI

Immediately update to macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later depending on your current OS version. Users should enable automatic security updates in System Preferences > General > Software Update to prevent similar vulnerabilities from impacting their systems. For organizations unable to patch immediately, enforce application code-signing verification, restrict execution of untrusted applications via Gatekeeper and XProtect, and monitor for suspicious process privilege escalation attempts. Until patches are deployed, disable or uninstall untrusted third-party applications that could exploit this vulnerability to gain root access. See Apple's official advisories at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for detailed patching instructions.