Overview
CVE-2026-28982 is a critical race condition vulnerability in macOS with a CVSS base score of 9.8. What makes this flaw particularly severe is its remote exploitability — a remote user can trigger the race condition to cause unexpected system termination or corrupt kernel memory, without requiring physical access or local code execution on the target system.
Apple resolved the issue by addressing the race condition with improved locking mechanisms across all three affected macOS release lines.
Affected Systems
| Product | Fixed Version |
|---|---|
| macOS Sequoia | 15.7.8 |
| macOS Sonoma | 14.8.8 |
| macOS Tahoe | 26.6 |
Technical Details
Race conditions occur when two or more threads access shared resources concurrently without adequate synchronization. In this vulnerability, insufficient locking in a macOS kernel component allows a remote attacker to win a timing race that leads to either a kernel panic (system crash) or corruption of kernel memory.
Kernel memory corruption is among the most serious outcomes in vulnerability research — it can be leveraged to:
- Bypass kernel-enforced security boundaries
- Elevate privileges to kernel-level (root)
- Disable or circumvent security features (SIP, AMFI, etc.)
- Install persistent low-level malware
The remote attack vector (no local access required) significantly increases the real-world risk of this vulnerability compared to typical local-only memory corruption bugs.
Risk Assessment
- CVSS Score: 9.8 (Critical)
- Attack Vector: Network (remote — no local access required)
- Impact: Kernel memory corruption; unexpected system termination; potential privilege escalation
- Exploit Status: No public exploit reported at time of disclosure
- Notable: Rare case of remote kernel memory corruption on macOS
Recommended Actions
- Patch immediately — apply macOS Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 via Software Update
- Prioritize internet-facing macOS systems — servers, shared workstations, and remote-access Macs face elevated risk due to the remote attack vector
- Enable macOS firewall (System Settings → Network → Firewall) to reduce network-accessible attack surface
- Review network segmentation for macOS devices that do not require inbound connections
- Monitor for unexpected kernel panics or system reboots as potential indicators of exploitation
- Defer large macOS deployments until patches are validated in your environment
Why This Matters
Most macOS kernel vulnerabilities require local code execution. A remotely exploitable kernel race condition shifts the risk calculus significantly — a network-reachable Mac (file servers, build machines, remote-access systems) could be compromised by an unauthenticated attacker without any user interaction.
References
- NVD Entry — CVE-2026-28982
- Apple Security Updates (macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6)