AppleCVE-2026-28982

Apple macOS: race condition

CVE-2026-28982 · Published Jul 27, 2026 · updated Jul 28, 2026

Critical9.8

Fix: upgrade to 14.8.8 or later (3 fixed versions below)

A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

Affected versions

Package	Affected	Fixed in
macOS Product	< 14.8.8	14.8.8
	< 15.7.8	15.7.8
	< 26.6	26.6

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-362

More Apple advisories

All Apple

Critical 9.8Jul 27

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-64769fixed in 18.7.10 +3 Critical 9.8Jul 27

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-64770fixed in 18.7.10 +3 Critical 9.8Jul 27

Apple iOS and iPadOS: buffer overflowCVE-2026-64771fixed in 18.7.10 +2 Critical 9.8Jul 27

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-64772fixed in 18.7.10 +2 Critical 9.8Jul 27

Apple iOS and iPadOS: integer overflowCVE-2026-64774fixed in 18.7.10 +3 Critical 9.8Jul 27

A memory initialization issue was addressed with improved memory handlingCVE-2026-64775fixed in 26.6 +2