CVE-2026-28924

A race condition was addressed with improved handling of symbolic links

High · published May 11, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access Contacts without user consent.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.5th percentile
Published
2026-05-11T20:08Z
EPSS history
Timeline
  • 11 MAY 20:08Z
    A race condition was addressed with improved handling of symbolic links
    cvelistv5