Critical· 9.8official fix available
CVE-2026-28982
CVE-2026-28982 is a critical race condition vulnerability in macOS that could allow remote attackers to cause system crashes or corrupt kernel memory. Apple fixed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 by improving locking mechanisms.
publishedJul 27, 2026
last modifiedJul 28, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
25th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 27, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Users of macOS Sequoia, Sonoma, or Tahoe prior to the patched versions.
02
Real-world impact
Could lead to unexpected system termination or kernel memory corruption.
03
Why this severity
CVSS 9.8 (critical): High confidence in exploitability and severe impact on system integrity.
04
What to do about it
official fix available
recommended steps
- 011. Upgrade macOS to version 15.7.8 (Sequoia), 14.8.8 (Sonoma), or 26.6 (Tahoe) or later.
- 022. Ensure the system is fully updated through Apple's software update process.
NVD description specifying patched macOS versions
05
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
- support.apple.com/en-us/128067release notesvendor advisory
- support.apple.com/en-us/128071release notesvendor advisory
- support.apple.com/en-us/128072release notesvendor advisory
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →