Security Vulnerability Report
中文
CVE-2026-28888 CVSS 5.1 MEDIUM

CVE-2026-28888

Published: 2026-03-25 01:17:12
Last Modified: 2026-03-25 18:00:10

Description

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain root privileges.

CVSS Details

CVSS Score
5.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
macOS Sequoia < 15.7.5
macOS Sonoma < 14.8.5
macOS Tahoe < 26.4

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#include <stdio.h> #include <unistd.h> #include <fcntl.h> // Simulated PoC for Race Condition Privilege Escalation // This is a generic example demonstrating the concept of TOCTOU. int main() { const char* sensitive_file = "/etc/sudoers"; int fd; // Step 1: Check permissions (Time of Check) if (access(sensitive_file, W_OK) == 0) { printf("[+] Write access granted. Attempting exploit...\n"); // Step 2: Time of Use (Race condition window) // In a real scenario, a race occurs here where the resource is swapped or modified. fd = open(sensitive_file, O_WRONLY); if (fd >= 0) { printf("[!] File opened successfully. Privilege escalation possible.\n"); close(fd); } else { printf("[-] Failed to open file.\n"); } } else { printf("[-] No write access.\n"); } return 0; }

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-28888", "sourceIdentifier": "[email protected]", "published": "2026-03-25T01:17:12.280", "lastModified": "2026-03-25T18:00:10.290", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain root privileges."}, {"lang": "es", "value": "Una condición de carrera se abordó con un manejo de estado mejorado. Este problema está solucionado en macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Una aplicación podría obtener privilegios de root."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.4, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-362"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "14.0", "versionEndExcluding": "14.8.5", "matchCriteriaId": "D66288AF-23BD-407A-81F5-F1DFBF84C622"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "15.0", "versionEndExcluding": "15.7.5", "matchCriteriaId": "DD21D2C9-BBEC-4E8E-B8D2-C92B7E6155E1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.4", "matchCriteriaId": "6CF848CD-25D4-4371-BEF3-1ACCE47AD81F"}]}]}], "references": [{"url": "https://support.apple.com/en-us/126794", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/126795", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/126796", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}]}}