CVE-2026-43690

CVE-2026-43690 is a race condition in Apple's macOS caused by insufficient locking, which Apple addressed with improved locking mechanics. A local attacker with an existing account on an affected Mac could exploit the timing flaw to read portions of kernel memory, potentially exposing sensitive data such as pointers, credentials, or secrets that could aid in further privilege-escalation or sandbox-escape chains. Only users on unpatched macOS versions are affected; the fix ships in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The issue requires local access, so remote exploitation is not in scope. No public proof of concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Patch affected Macs to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) as soon as practical via Software Update or your MDM deployment. Because exploitation requires local access, enforce least-privilege local account policies, limit who can run arbitrary code on shared or lab Macs, and review logs for suspicious local privilege-elevation attempts.