Apple macOS CVE-2026-65372

Exploitation requires the attacker to already be able to execute a malicious application locally on the macOS host at normal user privilege (PR:L, AV:L) - there is no remote or unauthenticated vector. The core prerequisite is winning a race condition (CWE-362, AC:H) in the Privacy preferences / TCC enforcement path, so success is timing-dependent and not reliable on a single attempt. Limiting factors: the attacker must first achieve local code execution (e.g. via a user installing or launching the malicious app), impact is confined to reading privacy-protected data (no integrity or availability loss), and fully patched systems (macOS 27 / 15.8 / 26.7 or later) are not affected.

This is a moderate, low-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7) describes a locally-exploitable flaw that requires an attacker to already be running code on the host at low privilege and to win a timing race (high attack complexity), with impact limited to confidentiality (reading privacy-protected data) and no integrity or availability effect. Every secondary signal agrees on low urgency: EPSS is 0.21% (10th percentile), CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The vulnerability is NOT in CISA KEV and no public exploit code was provided, so there is no public exploit identified at time of analysis. The signals are internally consistent - there is no conflict between CVSS, EPSS, and SSVC here. The main caveat is that race conditions (CWE-362) are inherently probabilistic to exploit, which reinforces the low real-world risk, but TCC/Privacy bypasses are of interest to spyware and malware authors on macOS, so patching should still be completed through normal update cycles.

A user is tricked into installing or running a malicious, low-privilege application on macOS. That app repeatedly attempts to trigger a timing race in the Privacy (TCC) enforcement logic, and on a successful race it reads data that privacy preferences should have protected - for example photos, contacts, or location - without the normal consent prompt. No public exploit code is known, and the high attack complexity means success is not guaranteed on any single attempt.