Security Vulnerability Report
中文
CVE-2026-28919 CVSS 7.8 HIGH

CVE-2026-28919

Published: 2026-05-11 21:18:54
Last Modified: 2026-05-12 17:10:01

Description

A consistency issue was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.

CVSS Details

CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
macOS Sequoia < 15.7.7
macOS Sonoma < 14.8.7
macOS Tahoe < 26.5

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3 # PoC for CVE-2026-28919 (macOS Local Privilege Escalation) # This is a conceptual demonstration of triggering the state consistency issue. # Note: Actual exploit code requires detailed reverse engineering of the specific macOS state handling mechanism. import os import sys def trigger_vulnerability(): try: # Simulate the interaction required to exploit the state consistency issue. # In a real scenario, this would involve specific API calls or file operations # that cause the system to enter an inconsistent state. print("[*] Attempting to trigger state consistency issue...") # Placeholder for the actual exploit logic # malicious_payload = "..." # exploit_trigger(malicious_payload) print("[+] If vulnerable, the process might attempt to elevate privileges.") print("[!] This PoC is for educational purposes only.") except Exception as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": if os.geteuid() == 0: print("[!] Do not run as root initially to test privilege escalation.") else: trigger_vulnerability()

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-28919", "sourceIdentifier": "[email protected]", "published": "2026-05-11T21:18:54.317", "lastModified": "2026-05-12T17:10:01.120", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A consistency issue was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-269"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "14.0", "versionEndExcluding": "14.8.7", "matchCriteriaId": "DD9E7FAE-30DA-4B2B-A63A-6DFEA7A29933"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "15.0", "versionEndExcluding": "15.7.7", "matchCriteriaId": "2984C440-3DC2-413A-B5FA-1FAB21078DB8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.5", "matchCriteriaId": "6CB91417-90A8-4A9B-A1D0-1D94B80EF837"}]}]}], "references": [{"url": "https://support.apple.com/en-us/127115", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127116", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127117", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}]}}