Product:
iOS, iPadOS, macOS, visionOS
Summary
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue may allow an app to access sensitive user data. The vulnerability has been fixed in several versions of Apple’s operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-28876 |
Exploitation
To exploit this vulnerability, an attacker could craft a malicious application that improperly handles directory paths. When the application is executed, it may gain unauthorized access to sensitive user data due to the parsing issue. This could occur without any user interaction, making it a significant risk.
Affected Products
- iOS 18.7.7 – Fixed parsing issue that could allow access to sensitive data.
- iPadOS 18.7.7 – Addressed similar vulnerabilities as in iOS.
- macOS Sequoia 15.7.5 – Improved path validation to prevent data access issues.
- macOS Sonoma 14.8.5 – Resolved directory path handling vulnerabilities.
- macOS Tahoe 26.4 – Enhanced security against unauthorized data access.
- visionOS 26.4 – Fixed vulnerabilities related to directory path parsing.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of iOS, iPadOS, macOS, and visionOS as specified in the vendor’s advisory. Regularly updating software can help protect against known vulnerabilities and enhance overall security.