Product:
macOS
Summary
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue allows an app to potentially gain root privileges. The vulnerability has been fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-28915 |
Exploitation
To exploit this vulnerability, an attacker would need to run a malicious application on a vulnerable version of macOS. The app could manipulate directory paths to gain elevated privileges, allowing it to execute arbitrary code with root access. User interaction is required to launch the malicious application, making social engineering tactics a potential vector for exploitation.
Affected Products
- macOS Sequoia 15.7.7 – Fixed the parsing issue with improved path validation.
- macOS Sonoma 14.8.7 – Addressed the vulnerability to prevent unauthorized root access.
- macOS Tahoe 26.5 – Resolved the directory path handling issue.
Mitigation
To mitigate this vulnerability, users should update their macOS to the latest versions as specified. Regularly applying security updates and patches is crucial to protect against potential exploitation. Additionally, users should be cautious about running untrusted applications.