Product:
macOS
Summary
A path handling issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.4. An app with root privileges may be able to delete protected system files.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.9 | CVE-2026-28823 |
Exploitation
To exploit this vulnerability, an attacker would need to gain root privileges on the affected system. Once they have these privileges, they could manipulate the path handling to delete protected system files, potentially compromising the integrity and stability of the operating system.
Affected Products
- macOS Tahoe 26.4 – Fixed the path handling issue that allowed deletion of protected system files.
Mitigation
To mitigate this vulnerability, users should ensure that they update to macOS Tahoe 26.4 or later. Additionally, it is recommended to limit the use of applications with root privileges and to regularly monitor system files for unauthorized changes.