Apple iOS, macOS, tvOS CVE-2026-28992

Local authenticated access required - exploitation is not possible remotely. The attacker must already have an active user session or app process running on the target device (PR:L). Additionally, AC:H (high complexity) indicates the race condition requires specific, difficult-to-achieve timing: the attacker must trigger shared resource access during a narrow synchronization window. This is not a guaranteed single-step exploit but rather a probabilistic attack requiring multiple attempts or environmental engineering (e.g., loading the system to increase contention). Exploitation is further constrained to scenarios where the target app or system component uses the affected locking primitive; not all memory operations are vulnerable, limiting the attack surface. These conditions significantly narrow real-world risk relative to the CVSS score.

CVSS 4.7 with local attack vector (AV:L), high complexity (AC:H), and low privilege requirement (PR:L) indicates moderate severity with significant practical barriers to exploitation. The availability impact (A:H) is limited to denial of service; confidentiality and integrity are unaffected (C:N, I:N). EPSS score of 0.02% (7th percentile) contradicts the CVSS rating, suggesting extremely low real-world exploitation likelihood despite the vulnerability being patched by the vendor. The AC:H (high complexity) factor aligns with EPSS assessment - race conditions require precise timing and environmental conditions, making reliable exploitation difficult. No CISA KEV status provided, and no public POC identified. The contradiction between CVSS severity and EPSS probability suggests this is a low-priority issue in practice: while theoretically exploitable by local authenticated users, the race condition window is narrow and inconsistently triggerable. Defense-in-depth rather than urgent patching is justified unless the environment has elevated risk of insider threats with local system access.

A local authenticated user (e.g., non-administrative local account or app sandbox process) triggers a race condition by repeatedly calling a system API that accesses shared memory resources under contention. By timing malicious operations to coincide with legitimate system access to the same memory region, the attacker exploits the synchronization window to corrupt kernel or framework data structures, causing an arbitrary app to crash or the entire system to hang. The AC:H complexity factor means the attacker must repeatedly attempt the race to achieve consistent results and may require kernel-level tracing tools to reliably identify the timing window.