macOS CVE-2026-28832

Local attacker or unprivileged app running on affected macOS systems (Sequoia prior to 15.7.5, Sonoma prior to 14.8.5, Tahoe prior to 26.4). No user interaction required. Vulnerability in kernel code allows out-of-bounds memory read.

Without a published CVSS score, EPSS probability estimate, or KEV designation, direct quantitative risk assessment is limited. However, qualitative analysis indicates moderate-to-high real-world risk: the vulnerability requires local application execution (suggesting medium attack complexity), but the impact of kernel memory disclosure is significant as it can reveal KASLR offsets, credential material, and other sensitive kernel state needed for privilege escalation attacks. The fact that Apple issued patches across three active macOS versions (Sequoia, Sonoma, and Tahoe) indicates this was treated as a priority issue warranting coordinated multi-version remediation. The absence of a CVSS vector and missing EPSS data may reflect recent disclosure or ongoing analysis; however, the local execution requirement and specific patch availability suggest this is a legitimate priority issue rather than inflated severity.

An attacker distributes a malicious application (e.g., disguised as a utility or game) that, when executed by a user, exploits the out-of-bounds read to leak kernel memory. The attacker uses the disclosed kernel addresses to bypass KASLR (kernel address space layout randomization) and obtain kernel credentials or heap state, then chains this with a separate privilege escalation exploit to gain kernel-level code execution. This two-stage attack is practical because the out-of-bounds read requires only local application execution with no elevated privileges, making it a valuable information-disclosure primitive in a full exploit chain.