What is the CVSS score of CVE-2026-43755?

CVE-2026-43755 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apple are affected by CVE-2026-43755?

CVE-2026-43755 is a local privilege escalation vulnerability in Apple macOS that allows a standard user application to gain root access via a race condition.. A patch is available.

How to fix or mitigate CVE-2026-43755?

Within 24 hours, identify all macOS devices running versions prior to Sonoma 14.8.8 or Tahoe 26.6 and notify IT administrators of the patch availability. Within 7 days, deploy the vendor-released patches across all affected systems, prioritizing sensitive endpoints. Within 30 days, verify patch compliance through endpoint management tools and conduct a review of local privilege controls to ensure no lingering exposure.

Apple CVE-2026-43755

EUVD-2026-49475 HIGH

Race Condition (CWE-362)

2026-07-27 apple

GHSA-52qr-8f69-pcpq

Race Condition Apple Information Disclosure

7.0

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (apple) · only source for this CVE.

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 23:01 vuln.today

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:12 cve.org

HIGH 7.0

DescriptionCVE.org

A race condition was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privileges.

AnalysisAI

Local privilege escalation in Apple macOS allows a low-privileged application to gain root privileges by exploiting a race condition in system state management. The issue is resolved in macOS Sonoma 14.8.8 and macOS Tahoe 26.6. No active exploitation has been reported, but the local attack vector limits remote risk.