What is the CVSS score of CVE-2026-43743?

CVE-2026-43743 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-43743?

Yes, a patch is available for CVE-2026-43743. Update the affected software to the latest version immediately.

Apple iOS/macOS CVE-2026-43743

EUVD-2026-40191 MEDIUM

Race Condition (CWE-362)

2026-06-29 apple

GHSA-q3vp-fjcp-c43f

Information Disclosure Apple Race Condition Ios And Ipados

4.7

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.7 MEDIUM

Local app execution required with timing-dependent race condition (AC:H, PR:L); impact is system crash only, with no confidentiality or integrity compromise.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 22:35 vuln.today

CVSS changed

Jun 29, 2026 - 22:22 NVD

4.7 (MEDIUM)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:42 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to cause unexpected system termination.

AnalysisAI

Race condition in Apple iOS, iPadOS, and macOS Tahoe allows a locally-running app with standard privileges to trigger unexpected system termination. Rooted in improper state handling during concurrent operations (CWE-362), exploitation is constrained by high attack complexity due to the timing-dependent nature of race conditions. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes a class of flaw where two or more execution threads access shared state without adequate locking or ordering guarantees. In this case, Apple's state management layer in iOS/iPadOS and macOS Tahoe failed to adequately synchronize concurrent operations, creating a window where a malicious or poorly-timed app can corrupt OS-level state and trigger a kernel panic or forced system termination. Affected CPEs confirm coverage across both the mobile platform (cpe:2.3:a:apple:ios_and_ipados) and desktop platform (cpe:2.3:a:apple:macos), with all versions prior to 26.5.2 affected on each. The CVSS vector AV:L/AC:H/PR:L reflects that exploitation requires local code execution with low-privilege credentials and precise timing - a hallmark of race-condition exploitation.

RemediationAI

Vendor-released patch: iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Users and administrators should apply these updates immediately via the standard Software Update mechanism on each affected device. For managed enterprise environments, updates can be pushed via MDM solutions such as Apple Business Manager. Vendor advisories are at https://support.apple.com/en-us/127594 (iOS/iPadOS) and https://support.apple.com/en-us/127595 (macOS). Where immediate patching is not feasible, a partial compensating control is restricting device trust to App Store-vetted apps only (disabling sideloading and untrusted developer profiles), which raises the bar for an attacker delivering the malicious app - though this does not eliminate the underlying vulnerability and is not a substitute for patching.