Product:
iOS
Summary
A race condition was addressed with additional validation. This issue may allow an app to access sensitive user data. The problem has been fixed in several Apple operating systems including iOS 26.5 and iPadOS 26.5.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-28996 |
Exploitation
To exploit this vulnerability, an attacker would need to create a malicious application that takes advantage of the race condition. The app would require user interaction to be installed and run, allowing it to access sensitive user data without proper authorization.
Affected Products
- iOS 26.5 – Affected by a race condition allowing unauthorized access to sensitive data.
- iPadOS 26.5 – Similar vulnerability as iOS, allowing data access through a malicious app.
- macOS Sequoia 15.7.7 – Vulnerable to the same race condition issue.
- macOS Sonoma 14.8.7 – Also affected by the race condition.
- macOS Tahoe 26.5 – Vulnerable to unauthorized data access.
- tvOS 26.5 – Affected by the same issue.
- visionOS 26.5 – Vulnerable to the race condition.
- watchOS 26.5 – Also affected by this vulnerability.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Apple has released updates that address the race condition and improve validation to prevent unauthorized access to sensitive user data.