CVE-2026-28867: Apple OS Information Disclosure Flaw

CVE-2026-28867 Overview

CVE-2026-28867 is an authentication vulnerability affecting multiple Apple operating systems that allows a malicious application to leak sensitive kernel state information. Apple addressed this issue with improved authentication mechanisms across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS platforms.

Critical Impact
A malicious application exploiting this vulnerability could bypass authentication controls and access sensitive kernel memory state, potentially exposing privileged system information that could facilitate further attacks.

Affected Products

iOS 18.7.7 and earlier, iPadOS 18.7.7 and earlier
iOS 26.4 and earlier, iPadOS 26.4 and earlier
macOS Sequoia 15.7.5 and earlier
macOS Tahoe 26.4 and earlier
tvOS 26.4 and earlier
visionOS 26.4 and earlier
watchOS 26.4 and earlier

Discovery Timeline

2026-03-25 - CVE-2026-28867 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-28867

Vulnerability Analysis

This vulnerability stems from insufficient authentication validation within Apple's kernel subsystem. When an application makes certain system calls or interacts with kernel interfaces, the authentication mechanism failed to properly verify the caller's authorization level before exposing kernel state information.

The information leak affects the kernel memory space, which typically contains sensitive data structures, pointers, and system configuration details. Exposure of kernel state information can be leveraged by attackers to defeat kernel address space layout randomization (KASLR), identify exploitable memory layouts, or gather intelligence for subsequent privilege escalation attacks.

Root Cause

The root cause of CVE-2026-28867 lies in improper authentication checks within the kernel's interface handlers. The vulnerability allowed applications running in user space to query or access kernel state information without proper credential verification. Apple's fix implemented improved authentication controls to ensure that only authorized processes can access sensitive kernel state data.

Attack Vector

Exploitation of this vulnerability requires a malicious application to be installed and executed on the target device. The attack is local in nature, meaning an attacker would need to either:

Convince a user to install a malicious application
Exploit an existing application to execute malicious code
Gain initial access to the device through other means

Once executed, the malicious application can leverage the authentication bypass to query kernel interfaces and extract sensitive state information. This information could then be exfiltrated or used locally to chain with other vulnerabilities for privilege escalation.

The vulnerability affects the entire Apple ecosystem, including mobile devices (iOS, iPadOS), desktop systems (macOS), entertainment devices (tvOS), wearables (watchOS), and spatial computing platforms (visionOS).

Detection Methods for CVE-2026-28867

Indicators of Compromise

Unusual system calls or kernel interface queries from non-system applications
Applications attempting to access kernel memory regions or state information
Unexpected data exfiltration patterns from devices to unknown external endpoints
Anomalous behavior from recently installed or updated applications

Detection Strategies

Monitor for applications making unusual kernel-related API calls or system requests
Implement application behavior analysis to detect unauthorized kernel state queries
Review installed applications for suspicious permissions or behaviors
Enable comprehensive logging of system calls on managed devices

Monitoring Recommendations

Deploy endpoint detection and response (EDR) solutions capable of monitoring kernel-level activity
Implement mobile device management (MDM) policies to restrict application installations to trusted sources
Monitor network traffic for potential data exfiltration following kernel information access
Enable security audit logging on macOS systems to track privileged operations

How to Mitigate CVE-2026-28867

Immediate Actions Required

Update all affected Apple devices to the latest available OS versions immediately
Review recently installed applications on affected devices for suspicious behavior
Restrict application installations to trusted sources (App Store only)
Implement mobile device management (MDM) controls for enterprise environments

Patch Information

Apple has released security updates to address this vulnerability across all affected platforms. Organizations and users should apply the following updates:

iOS/iPadOS: Update to iOS 18.7.7 or iOS 26.4 (or later)
macOS: Update to macOS Sequoia 15.7.5 or macOS Tahoe 26.4 (or later)
tvOS: Update to tvOS 26.4 (or later)
visionOS: Update to visionOS 26.4 (or later)
watchOS: Update to watchOS 26.4 (or later)

For detailed patch information, refer to the official Apple security advisories:

Workarounds

Enable automatic software updates on all Apple devices to receive security patches promptly
Restrict device usage to applications from the official App Store only
Implement application allowlisting on managed enterprise devices
Consider isolating unpatched devices from sensitive network resources until updates can be applied