CVE-2026-28987: Apple iPadOS Information Disclosure Flaw

CVE-2026-28987 Overview

CVE-2026-28987 is a high-severity information disclosure vulnerability affecting multiple Apple operating systems. The flaw stems from insufficient data redaction in system logs, classified under [CWE-532] Insertion of Sensitive Information into Log File. An app running on a vulnerable device may leak sensitive kernel state through log entries.

Apple addressed the issue in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5. Kernel state disclosure undermines kernel address space layout randomization (KASLR) and supports follow-on exploitation of memory corruption flaws.

Critical Impact
A malicious app can read leaked kernel state from system logs, exposing information that aids privilege escalation and kernel exploitation chains.

Affected Products

Apple iOS and iPadOS (prior to 18.7.9 and 26.5)
Apple macOS Sonoma 14.x, Sequoia 15.x, and Tahoe 26.x (prior to listed fixes)
Apple tvOS prior to 26.5 and watchOS prior to 26.5

Discovery Timeline

2026-05-11 - CVE-2026-28987 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-28987

Vulnerability Analysis

The vulnerability resides in how Apple operating system components write diagnostic and runtime information to logs. Affected log paths emit kernel-internal state without applying redaction filters. As a result, sensitive runtime data reaches log destinations accessible to applications with standard log-reading entitlements.

Kernel state disclosure is dangerous because modern Apple platforms rely on KASLR and pointer authentication codes (PAC) to harden the kernel. When raw kernel addresses or structure contents leak, attackers gain the offsets needed to defeat randomization. This typically transforms an otherwise unreliable kernel memory corruption bug into a deterministic exploit.

Apple categorizes the fix as improved data redaction, meaning the patched code paths now sanitize sensitive fields before they are written to log streams. The issue affects the entire Apple platform family because the vulnerable logging logic is shared across iOS, iPadOS, macOS, tvOS, and watchOS code bases.

Root Cause

The root cause is improper output neutralization for logs [CWE-532]. Kernel-level data structures are passed to logging routines without redaction. Sensitive fields, including pointers and identifiers tied to kernel allocations, are serialized verbatim into log entries.

Attack Vector

A local application on the device queries the log subsystem and parses entries containing kernel state. The attacker uses the leaked values to compute kernel slide, locate gadgets, or stabilize a separate memory corruption primitive. No user interaction is required after the malicious app is installed. The attack supports a multi-stage exploit chain rather than direct code execution. See the Apple Support advisories for component-level technical details.

Detection Methods for CVE-2026-28987

Indicators of Compromise

Unsigned or sideloaded applications invoking OSLogStore or log show style APIs to harvest system logs at scale.
Mobile device management (MDM) telemetry showing apps requesting com.apple.logging or diagnostic entitlements they do not require.
Devices running iOS, iPadOS, macOS, tvOS, or watchOS builds older than the fixed versions enumerated in Apple's advisories.

Detection Strategies

Inventory Apple endpoints and flag any operating system build prior to iOS/iPadOS 18.7.9 or 26.5, macOS Sonoma 14.8.7, Sequoia 15.7.7, Tahoe 26.5, tvOS 26.5, or watchOS 26.5.
Monitor for applications enumerating the unified logging subsystem or exporting .logarchive bundles from managed devices.
Correlate log-access events with subsequent local privilege escalation or kernel panic telemetry, which can indicate exploit chain development.

Monitoring Recommendations

Centralize macOS endpoint telemetry into a SIEM or data lake and alert on unusual reads of /var/db/diagnostics and /var/db/uuidtext.
Track app installation events from non-App Store sources on managed iOS, iPadOS, and macOS devices.
Review MDM compliance dashboards weekly to confirm that all Apple endpoints have received the May 2026 security updates.

How to Mitigate CVE-2026-28987

Immediate Actions Required

Deploy the fixed Apple OS builds across all managed endpoints: iOS/iPadOS 18.7.9, iOS/iPadOS 26.5, macOS Sonoma 14.8.7, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5.
Use MDM to enforce minimum OS versions and quarantine non-compliant devices from sensitive resources.
Audit installed applications for unnecessary access to logging or diagnostic APIs and remove untrusted apps.

Patch Information

Apple shipped redaction improvements in the May 2026 security update wave. Refer to the official advisories: Apple Support Document #127110, #127111, #127115, #127116, #127117, #127118, and #127119.

Workarounds

No vendor-supplied workaround exists; install the patched OS versions as soon as possible.
Restrict application installation to the App Store or vetted enterprise sources to reduce exposure to apps that abuse log access.
Disable verbose or developer logging profiles on production devices until patches are deployed.

bash

# Verify the installed macOS build matches a patched version
sw_vers -productVersion

# Example: confirm iOS/iPadOS build via MDM query
# Expected minimum versions: 18.7.9, 26.5
profiles status -type enrollment