by Kastro
Paper/Archive/CVE-2026-28827

CVE-2026-28827

Apple macOS — A parsing issue in the handling of directory paths was addressed with improved path validation.

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
32
CVSS 9.3 (ADP)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 21.5.215 × 204.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to break out of its sandbox.

Affected

ProductAffectedFixed inSource
macOS< 14.8.514.8.5CNA
macOS< 15.7.515.7.5CNA
macOS< 26.426.4CNA

Scores by source

CISA ADP9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.apple.com/en-us/126794refsupport.apple.com/en-us/126795refsupport.apple.com/en-us/126796