This vulnerability (CVE-2026-28996) is a race condition (CWE-362) in Apple operating systems that could allow an application to access sensitive user data due to insufficient validation. The issue was resolved by adding additional validation checks. The vulnerability affects multiple Apple OS variants and was fixed in the specified versions. The CVSS v3.1 score is 5.5 (medium severity), with an attack vector of local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), high confidentiality impact (C:H), and no integrity or availability impact (I:N/A:N). There are no known exploits in the wild at this time.

An attacker with local access and requiring user interaction could exploit this race condition to gain unauthorized access to sensitive user data. The confidentiality impact is high, but integrity and availability are not affected. The vulnerability does not require privileges but does require user interaction.

This vulnerability has been fixed by Apple in iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Users and administrators should apply these official updates to remediate the issue. No additional mitigation steps are indicated.