CVE-2026-28915
HighSummary
A parsing issue in the handling of directory paths was addressed with improved path validation. An app may be able to gain root privileges.
Risk Assessment
Organizations may be exposed to unauthorized access to the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update macOS systems to Sequoia 15.7.7, Sonoma 14.8.7, or Tahoe 26.5 to mitigate the risk.
Other vulnerabilities in macOS
See all- CVE-2026-39870High
The issue was addressed with improved memory handling. Exploitation of this vulnerability may lead to process memory corruption when processing a maliciously crafted image.
- CVE-2026-65400CriticalActively exploited
An authentication issue was addressed with improved state management. This issue affects macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, and macOS Tahoe 26.6.1. A network attacker may be able to authenticate to Screen Sharing without valid credentials.
- CVE-2026-43773Critical
An out-of-bounds read was fixed with improved bounds checking. Fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
- CVE-2026-43764Critical
An integer overflow was addressed with improved input validation. An app may cause unexpected system termination.
- CVE-2026-43750Critical
A buffer overflow in macOS allows an app to execute arbitrary code out of its sandbox or with elevated privileges. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6.
- CVE-2026-43748Critical
An out-of-bounds write issue in macOS may cause unexpected system termination by an app. This is fixed in macOS Sequoia 15.7.8 and macOS Tahoe 26.6.
- CVE-2026-43710Critical
Vulnerability in macOS (Sequoia, Sonoma, Tahoe) allowing an attacker to cause unexpected system termination or corrupt kernel memory. Fixed with improved memory handling.
- CVE-2026-43694Critical
Vulnerability in macOS (Sequoia, Sonoma, Tahoe) allowing an app to cause unexpected system termination or write kernel memory. Fixed with improved memory handling.
- CVE-2026-43682Critical
Vulnerability in macOS (Sequoia, Sonoma, Tahoe) allowing a remote user to cause unexpected system termination or corrupt kernel memory. Fixed with improved memory handling.
- CVE-2025-24259Critical
Vulnerability in iPadOS and macOS allowing an app to access Safari bookmarks without proper entitlement check. Fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5.
Original NVD description (English source)
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.