What is the CVSS score of CVE-2026-28922?

CVE-2026-28922 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-28922?

Yes, a patch is available for CVE-2026-28922. Update the affected software to the latest version immediately.

Apple macOS CVE-2026-28922

EUVD-2026-29242 MEDIUM

Information Exposure (CWE-200)

2026-05-11 apple

GHSA-5mcm-v2r7-wwg8

Information Disclosure Apple

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

App runs locally on the device (AV:L more accurate than AV:N); no privilege required; user must run the app (UI:R); confidentiality fully compromised, no integrity or availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:42 vuln.today

CVSS changed

May 12, 2026 - 20:22 NVD

6.5 (MEDIUM)

Patch available

May 11, 2026 - 22:03 EUVD

CVE Published

May 11, 2026 - 20:07 nvd

MEDIUM 6.5

CVE Published

May 11, 2026 - 20:07 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access private information.

AnalysisAI

Private information disclosure in Apple macOS allows a locally installed app to access sensitive data belonging to the user or other processes via an improper state management flaw. Affected are all macOS Sonoma releases prior to 14.8.7, all macOS Sequoia releases prior to 15.7.7, and all macOS Tahoe releases prior to 26.5. No active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.02% (4th percentile) reflects a low probability of near-term opportunistic exploitation.

Technical ContextAI

The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), specifically caused by defective state management within macOS. When application state is not correctly isolated or reset between transitions, a separate app process can read memory, file handles, or inter-process data that should remain private. The CPE string cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* confirms that all macOS versions across the three affected release trains (Sonoma, Sequoia, and Tahoe) are vulnerable until the fixed releases. Apple's fix description - 'improved state management' - is consistent with a flaw where OS-level boundaries between application contexts fail to enforce isolation properly.

RemediationAI

The primary remediation is to update to a fixed macOS release: macOS Sonoma 14.8.7, macOS Sequoia 15.7.7, or macOS Tahoe 26.5, all of which contain Apple's improved state management fix. Apple's security advisories are available at https://support.apple.com/en-us/127115, https://support.apple.com/en-us/127116, and https://support.apple.com/en-us/127117. For environments where immediate patching is not feasible, restricting installation to App Store-vetted or enterprise-managed applications reduces exposure, as the flaw requires a malicious app to be running on the system. Enabling macOS Gatekeeper and application allow-listing via MDM are concrete compensating controls, though they do not eliminate the underlying vulnerability. No vendor-documented workaround that addresses the state management flaw itself is available.