macOS CVE-2026-28821

Local attacker with no privileges on macOS systems running Sequoia before 15.7.5, Sonoma before 14.8.5, or Tahoe before 26.4. Malicious app exploits entitlement verification validation flaw to gain elevated privileges without user interaction.

Without a published CVSS score or EPSS data, risk assessment relies on vulnerability characteristics and scope. The absence of CVSS metrics suggests either pending analysis or intentional non-disclosure by Apple. However, the flaw enables privilege escalation (a critical impact category), affects a widely-deployed platform affecting millions of users, and requires no network interaction (local privilege escalation vector). The vulnerability likely requires user interaction or local code execution capability to exploit, suggesting attack complexity is moderate. The immediate availability of patches from Apple (three simultaneous releases) indicates the vendor considers this a material security issue warranting rapid deployment. Without POC documentation or KEV listing confirmation, this appears to be a zero-day or near-zero-day disclosure being handled responsibly, presenting moderate to high real-world risk depending on exploit complexity and whether public POC emerges.

An attacker with local code execution capability could craft a malicious application that includes a specially crafted entitlement declaration. Due to the validation flaw, the macOS kernel would fail to properly verify the entitlement signature or validity, allowing the app to execute privileged operations (such as accessing protected files, modifying system settings, or injecting code into system processes) that should be restricted by the sandbox. A user social-engineered into downloading and running a trojanized application from a third-party source could unknowingly grant an attacker persistent system-level access and the ability to compromise all user data on the device.