Apple iOS, iPadOS, macOS, visionOS EUVD-2026-29304

Exploitation requires local system access as an authenticated user-level account (PR:L) on an unpatched device running iOS, iPadOS, macOS, or visionOS version below the patched threshold. The attacker must identify a vulnerable race condition in a system service that manages access to sensitive data, then successfully manipulate timing to access protected resources. The race condition is not exploitable remotely; an attacker must first obtain user-level credentials or physical access to an unlocked device. The high complexity (AC:H) reflects the difficulty of triggering the race condition reliably - exploitation likely requires multiple attempts and precise synchronization across threads or processes. Default configurations are vulnerable, but exploitation is limited to attackers who already have foothold access to the system.

Risk signals present conflicting indicators: the CVSS score of 4.7 with high confidentiality impact (C:H) and local attack vector (AV:L) suggests moderate severity, yet the EPSS score of 0.02% in the 7th percentile indicates minimal exploitation likelihood. No CISA KEV status is provided, suggesting this is not yet confirmed as actively exploited. The local attack vector requirement and high complexity (AC:H) significantly constrain real-world exploitation compared to network-accessible vulnerabilities. The CVSS vector PR:L and UI:N indicate authentication as a user-level account is required, eliminating complete remote exploitation chains. The combination of local-only access, high complexity, low EPSS, and absence of publicly disclosed POC or active exploitation suggests this is a low priority compared to network-exploitable or simple-to-exploit vulnerabilities. However, the high confidentiality impact means compromised systems could expose sensitive user data; defenders should prioritize patching based on system criticality and whether local attackers (compromised user accounts, physical access) are credible threats in their environment.

An authenticated attacker with a legitimate user account on a macOS Sonoma system exploits a race condition in a system service that manages access to protected user files. By spawning multiple threads that repeatedly attempt to access a file just after its permissions are checked but before it is accessed, the attacker wins the race and reads sensitive data (such as photos, messages, or documents) belonging to another user or the system. Success requires precise timing and multiple attempts, making this a high-complexity but feasible exploit for a determined local attacker with user-level access.