EUVD-2026-77853
GHSA-pvrp-42w3-vm5w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local app triggers an unsynchronized race window (AC:H rather than the vendor's AC:L), PR:L for local app execution, availability-only impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
6DescriptionCVE.org
A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
AnalysisAI
A local race condition (CWE-362) in Apple macOS allows any locally running application to trigger unexpected system termination on affected hosts. The flaw affects macOS versions prior to Tahoe 26.7 and Golden Gate 27, is availability-only (C:N/I:N/A:H), and requires local app execution with no user interaction and no privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Risk Assessment | CVSS 3.1 scores this 5.5 Medium with AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - meaning the attacker must already have code running locally (any installed app or process in the user's session), needs no user interaction and no admin rights, and gains only availability impact; there is no confidentiality or integrity loss and no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch: upgrade to macOS Tahoe 26.7 or macOS Golden Gate 27 as documented in Apple advisories https://support.apple.com/en-us/149035 and https://support.apple.com/en-us/149042; these are full OS updates and require a restart, so schedule them in a maintenance window. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today