macOS CVE-2026-28844

The real-world risk assessment is constrained by incomplete technical data: CVSS score and vector are not available, preventing quantification of attack complexity, required privileges, and attack surface. EPSS probability data is absent, limiting predictability of exploitation likelihood. No public exploit code or proof-of-concept has been identified in available intelligence, and the vulnerability is not listed in known exploit databases (KEV status unknown). However, several risk factors elevate concern: the vulnerability affects macOS—a widely deployed operating system with millions of users—and impacts core file system security, a critical trust boundary. Information disclosure vulnerabilities in OS-level file access are historically favored by privilege escalation chains and lateral movement attacks. The classification as 'Information Disclosure' suggests the primary impact is confidentiality rather than integrity or availability, but unauthorized file access can facilitate secondary attacks. Without active exploitation evidence or public POC, this appears to be a real but not immediately critical priority; however, organizations running macOS should prioritize patching within standard update cycles due to the fundamental nature of the affected component.

An attacker with local access to a macOS system could craft a specially formatted file path or access request that bypasses the input validation in the file access control mechanism, allowing them to read protected system files (such as /private/var/db/sudo or user home directory contents) without proper authorization. For example, if the validation logic fails to properly canonicalize paths or resolve symbolic links, an attacker could use path traversal sequences or crafted symlinks to escape intended directory restrictions. The attacker's capability to exploit this depends on their initial system access level; a low-privilege user could potentially escalate information access without requiring administrative credentials, making this attractive for privilege escalation or lateral movement within a multi-user system.