EUVD-2026-29289
GHSA-xp43-g5gh-f86x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconInstall malicious app on device
-
DeliveryExecute app with user permissions
-
ExploitAttempt rapid concurrent data access
-
InstallExploit race condition window
-
C2Bypass access controls
-
ExecuteRead sensitive user data
-
ImpactExfiltrate data to attacker server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a malicious app to already be installed on the target device with the ability to execute code in the user's context. The race condition can only be triggered by local code execution - remote exploitation is not possible. User interaction is required as part of the attack chain, either to install the malicious app initially or to enable certain functionality. The vulnerability affects default configurations of all iOS, macOS, tvOS, visionOS, and watchOS devices below the patched versions without requiring special security settings to be disabled. However, exploitation is inherently unreliable because race conditions depend on precise timing and concurrent execution patterns, meaning repeated exploitation attempts may be necessary. |
| Impact | Risk is low despite moderate CVSS score due to multiple limiting factors. CVSS 5.5 (AV:L/AC:L/PR:N/UI:R) indicates local attack vector requiring user interaction - not remotely exploitable. EPSS score of 0.02% (7th percentile) strongly suggests this is not widely exploited in practice despite availability of patched versions; this contrasts sharply with high-CVSS vulnerabilities that see rapid weaponization. The race condition's inherent unreliability (difficult to trigger consistently) and requirement for a malicious app to already be installed on the device further reduces practical risk. KEV status unknown from provided data. The information disclosure impact (C:H) affects confidentiality only, not integrity or availability. For most users with current OS versions, risk is minimal; legacy device owners on unpatched versions face moderate risk only if they have installed untrusted apps. |
| Exploit ScenarioDerived | An attacker develops a malicious app targeting iOS or macOS and tricks a user into installing it from an unofficial source or exploits a separate app store compromise. Once installed, the malicious app repeatedly attempts to read sensitive user data (contacts, photos, location, health information) while rapidly changing file system permissions or memory access controls. During the brief window created by the race condition in access validation, the app successfully reads data it should not have access to, exfiltrating it to attacker-controlled servers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 13, 2026
Race condition in Apple operating systems allows local apps to access sensitive user data without authorization. Affects iOS and iPadOS versions below 26.5, macOS Sequoia 15.7.7, Sonoma 14.8.7, Tahoe 26.5, tvOS, visionOS, and watchOS versions below 26.5. Requires local app execution and user interaction. CVSS 5.5 reflects high confidentiality impact but low exploitation likelihood (EPSS 0.02%, 7th percentile).
RemediationAI
Vendor-released patches are available: update iOS/iPadOS to 26.5 or later, macOS Sequoia to 15.7.7 or later, macOS Sonoma to 14.8.7 or later, macOS Tahoe to 26.5 or later, tvOS to 26.5 or later, visionOS to 26.5 or later, and watchOS to 26.5 or later. Patches address the race condition through additional validation mechanisms. Organizations should prioritize updates for devices handling sensitive data; however, given the low EPSS score and requirement for local malicious app installation, updates can follow standard quarterly patching cycles rather than requiring emergency deployment. As a workaround before patching, restrict installation of untrusted third-party applications and disable sideloading where possible, though this limits app functionality. Monitor device behavior for signs of unauthorized data access attempts via system logs or mobile device management (MDM) solutions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from a race condition (CWE-362) in Apple's operating system kernel or framework handling of user data access controls. Race conditions occur when multiple processes or threads access shared resources without proper synchronization, allowing a window of opportunity where access checks can be bypassed. In this case, the race condition enables a locally installed application to read sensitive user information during the brief moment when concurrent operations fail to properly enforce data isolation. The issue affects Apple's unified kernel architecture spanning iOS, macOS variants (Sequoia, Sonoma, Tahoe), tvOS, visionOS, and watchOS, indicating the vulnerability likely exists in shared core system libraries or memory management subsystems common to all platforms.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A race condition was addressed with additional validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB