PT-2026-39780

CVE-2026-28915

Published

2026-05-11

Updated

2026-05-14

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5

Description A parsing issue in the handling of directory paths could allow an app to gain root privileges. This was addressed by improving path validation.

Recommendations Update macOS Sequoia to version 15.7.7. Update macOS Sonoma to version 14.8.7. Update macOS Tahoe to version 26.5.

Exploitability

Fix

Impacts

Researchers

Andreas Jaegersberger

Ro Achterberg

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers