CVE-2026-43743: iOS/macOS Race Condition Causing System Crashes—Patch Guidance

Technical summary

This vulnerability stems from a race condition (CWE-362) in core state handling across multiple Apple platforms. A race condition occurs when two or more concurrent operations access shared resources without proper synchronization, leading to unpredictable behavior. In this case, the flaw allows a locally-executing application to trigger unexpected system termination by exploiting a window of vulnerability in the OS's state management. The condition is difficult to trigger reliably (AC:H in the CVSS vector), meaning an attacker must craft specific timing conditions. Apple addressed this by implementing improved state handling logic, preventing the race condition from occurring.

Business impact

Organizations managing fleets of iPhones, iPads, and Macs should treat this as a stability issue rather than a security breach risk. The primary concern is operational disruption—devices crashing unexpectedly—rather than data theft or system compromise. For businesses relying on iOS devices for critical operations, unpatched devices could experience service interruptions if a malicious app is installed. The medium severity score reflects the narrow attack vector (local) and lack of confidentiality or integrity impact.

Affected systems

This vulnerability affects iOS (on iPhone), iPadOS, and macOS across multiple versions. Specifically, the fixes are available in iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, and watchOS 26.6. Any version prior to these release versions is potentially vulnerable. Organizations should verify which versions are currently deployed in their environment.

Exploitability

Exploitation is constrained by several factors. An attacker must already have code execution on the target device, meaning the malicious app must either be installed by the user or sideloaded. The race condition itself is difficult to trigger reliably (high complexity per the CVSS score), requiring precise timing manipulation. There is no user interaction required once the app is running, but the attack surface is limited to local applications rather than remote network-based exploitation. The absence of a KEV entry indicates this has not yet appeared in public exploit catalogs or active threat campaigns.

Remediation

The primary remediation is to update affected devices to the patched OS versions: iOS 26.5.2 or later for iPhones, iPadOS 26.5.2 or later for iPads, macOS Tahoe 26.5.2 for Macs, and tvOS 26.6 or watchOS 26.6 for those platforms. Because the attack requires local app execution, secondary controls include managing app installation policies (restrict sideloading, use Mobile Device Management to limit third-party apps, and conduct app vetting). For organizations with strict change management windows, prioritize updates during the next scheduled maintenance cycle, as there is no indication of active exploitation.

Patch guidance

Deploy the available OS updates across your Apple device inventory. For iOS and iPadOS, update to version 26.5.2 or later; for macOS, update to Tahoe 26.5.2 or later. Test updates in a pilot group before organization-wide rollout if your environment permits. Use Apple's automated update mechanisms (Software Update in Settings/System Preferences) or Mobile Device Management tools to enforce compliance. Verify the update completion using device management consoles to confirm all critical assets are patched.

Detection guidance

Monitor for unexpected application crashes or system reboots on managed devices using your Mobile Device Management platform or system event logs. Establish a baseline of crash frequency and flag any anomalous increase. If you suspect exploitation, review app installation logs to identify recently installed or suspicious applications, and cross-reference with app review policies. Because the race condition is difficult to trigger, a sudden spike in crashes may indicate an attempted exploit; escalate such cases for further analysis. Standard endpoint detection tools may not flag this activity without custom tuning, so focus on process and crash telemetry.

Why prioritize this

Although this is a medium-severity vulnerability with a low CVSS score (4.7), it should be addressed within standard patch windows because it affects widely-deployed platforms and the fix is readily available. However, it does not require emergency patching—there is no evidence of active exploitation in the wild, and the attack is limited to local threat actors who have already compromised or control device installations. Prioritize other critical and high-severity vulnerabilities first, then schedule this update alongside routine OS patching cycles.

Risk score, explained

The CVSS 3.1 score of 4.7 (Medium) reflects a local-only attack vector (AV:L), high attack complexity due to the race condition's timing requirements (AC:H), low privileges needed (PR:L—the attacker's app is already running), no user interaction (UI:N), and high availability impact (A:H—system crash). The score is elevated from Low to Medium primarily because the availability impact is severe (system termination), but the narrow local scope and high complexity keep it from reaching High. No confidentiality or integrity impact exists.

Frequently asked questions