EUVD-2026-15173
GHSA-g5mw-whmc-phhw
Vulnerability Assessment
| Impact | While CVSS and EPSS scores are not available for this CVE, the practical risk is moderate and locally-scoped. The attack vector is local (requires file system access), and the impact is information disclosure of document contents. This is not remotely exploitable and requires an attacker already present on the system. The vulnerability is not listed as actively exploited in KEV catalogs and no public proof-of-concept is known. However, the ease of exploitation (trivial file system enumeration of /tmp or similar directories) combined with the sensitivity of documents typically in print workflows suggests organizations handling confidential materials should prioritize patching. This is a genuine privacy concern rather than a theoretical high-CVSS-but-low-risk issue. |
| Exploit ScenarioDerived | A malicious local user with system access intentionally or accidentally gains access to the /tmp directory during or shortly after another user performs a print preview operation on a confidential document. The attacker retrieves the undeleted or improperly deleted temporary file containing the full document content, bypassing the document owner's security expectations. This is particularly concerning in shared systems, virtual environments, or scenarios where an attacker has obtained limited local access through a separate compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A privacy vulnerability in macOS Tahoe allows documents to be inadvertently written to temporary files during print preview operations, potentially exposing sensitive information to unauthorized access. This affects macOS versions prior to 26.4. An attacker with local file system access could retrieve unencrypted documents from temporary storage, circumventing user expectations of privacy during print operations.
RemediationAI
Update macOS to version Tahoe 26.4 or later immediately, following Apple's official guidance at https://support.apple.com/en-us/126794. Until patching is completed, users should avoid printing sensitive documents to preview mode and instead print directly, monitor temporary file directories (/var/tmp, /tmp) for unexpected document copies using file integrity monitoring tools, and restrict local user account access via strong authentication and principle of least privilege. Organizations should prioritize this patch for systems handling confidential or regulated information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper handling of temporary files in the macOS print preview functionality. When users invoke print preview on documents, the system creates temporary copies to render the print layout. The root cause relates to insufficient access controls and secure deletion mechanisms for these temporary files (CWE category: Information Disclosure through insecure temporary file handling). The affected product is Apple macOS across multiple versions prior to Tahoe 26.4, as identified by the CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* notation. The vulnerability manifests in the document handling and printing subsystems rather than network-facing components.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.4. A document may be written to a temporary file when using print preview.
Executive ViewAI
CVE-2026-28893 is a low-severity vulnerability in A privacy (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB