Product:
iOS, iPadOS, macOS
Summary
This issue was addressed with improved validation of symlinks. An app may be able to access sensitive user data. The issue is fixed in multiple versions of iOS, iPadOS, and macOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.2 | CVE-2026-28866 |
Exploitation
To exploit this vulnerability, an attacker would need to have local access to the device. By leveraging the improper validation of symlinks, the attacker could potentially gain access to sensitive user data stored on the device. This could be done through malicious applications that are able to manipulate symlink paths.
Affected Products
- iOS 18.7.7 and earlier
- iPadOS 18.7.7 and earlier
- macOS Sequoia 15.7.5 and earlier
- macOS Sonoma 14.8.5 and earlier
- macOS Tahoe 26.4 and earlier
Mitigation
Users are advised to update their devices to the latest versions of iOS, iPadOS, and macOS to mitigate this vulnerability. Regularly applying software updates can help protect against potential exploits and ensure that security improvements are in place.