Apple OS platforms CVE-2026-28987

Exploitation requires the attacker to install and execute a malicious application on the target device. The app must utilize Apple's os_log or OSLogStore APIs to query system logs, which are available to sandboxed applications without requiring special entitlements in default configurations. The application would need to pass App Store review (if distributed via official channels) or be installed through enterprise provisioning, TestFlight, or by convincing users to trust developer certificates. The vulnerability affects default logging configurations across all vulnerable OS versions and does not require the target device to be in any special mode or have non-default settings enabled. User interaction is limited to installing and launching the malicious application. Once running with standard application privileges, the app can access the improperly redacted logs. Exploitation is limited by Apple's application sandboxing which prevents direct kernel exploitation from userspace, meaning this vulnerability serves as an information disclosure primitive requiring combination with additional kernel vulnerabilities to achieve privilege escalation or persistent compromise.

The CVSS 7.5 score (High severity) reflects the potential confidentiality impact but presents contradictions requiring analysis. The vector AV:N (network attackable) and PR:N (no privileges required) suggest remote unauthenticated exploitation, yet the description states 'an app may be able to leak' implying local application execution is required. This inconsistency suggests either: (1) the CVSS vector was misapplied and should be AV:L/PR:L (requiring local app installation), or (2) Apple's logging infrastructure has remote query capabilities not evident in the description. If truly AV:L/PR:L, real-world severity drops significantly as attackers need code execution first. The low EPSS score of 0.02% (7th percentile) indicates minimal exploitation activity, suggesting this is not being actively targeted despite public disclosure. No CISA KEV listing confirms no federal-impact exploitation observed. The vulnerability serves as an information disclosure primitive useful in multi-stage attacks rather than a standalone compromise vector. Primary risk is to high-value targets where attackers already have application presence and need kernel reconnaissance for privilege escalation chains. Organizations running pre-patched Apple OS versions should prioritize patching if threat model includes malicious app installation (MDM bypass, supply chain, insider threat scenarios), but this is lower priority than actively exploited vulnerabilities. The SSVC decision tree would likely classify this as 'Scheduled' rather than 'Out-of-Cycle' patching given technical impact requires chaining and exploitation status shows no evidence of active targeting.

An attacker distributes a malicious application through the App Store or enterprise distribution channels that appears benign but contains code to query the unified logging subsystem. Once installed and executed by the user, the app uses legitimate os_log or OSLogStore APIs to retrieve system logs containing improperly redacted kernel state information such as kernel memory addresses or internal data structures. The attacker exfiltrates this data to remote servers where it is analyzed to defeat address space layout randomization (ASLR) or identify other kernel exploitation primitives. This kernel state intelligence is then used to craft a targeted kernel exploit for privilege escalation in a secondary attack stage. No public proof-of-concept is identified at time of analysis.