This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.5. An attacker with physical access to a locked device may be able to view sensitive user information.
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
PoC for CVE-2026-28961 (Conceptual)
This script checks if the macOS version is vulnerable to the information disclosure issue.
Actual exploitation requires physical interaction with the device.
"""
import subprocess
import re
def get_macos_version():
"""Retrieve the current macOS version."""
try:
output = subprocess.check_output(['sw_vers'], text=True)
match = re.search(r'ProductVersion:\s+(\d+\.\d+)', output)
if match:
return match.group(1)
except Exception:
pass
return None
def check_vulnerability():
"""Check if the system is affected by CVE-2026-28961."""
version = get_macos_version()
print(f"[+] Detected macOS Version: {version}")
# Vulnerability affects macOS Tahoe < 26.5
if version and float(version) < 26.5:
print("[!] System is potentially vulnerable to CVE-2026-28961.")
print("[*] Impact: Attacker with physical access may view sensitive user info on locked device.")
return True
else:
print("[+] System is patched or not affected.")
return False
if __name__ == "__main__":
check_vulnerability()