CVE-2026-28868: 
macOS vulnerability analysis and mitigation

CVE-2026-28868 is a kernel memory disclosure vulnerability in multiple Apple operating systems caused by insufficient data redaction in system logs. A malicious app may be able to read kernel memory contents by accessing sensitive information that was improperly written to log files. The vulnerability was disclosed on March 24, 2026, and affects iOS and iPadOS prior to 18.7.7 and 26.4, macOS Sonoma prior to 14.8.5, macOS Sequoia prior to 15.7.5, macOS Tahoe prior to 26.4, visionOS prior to 26.4, and watchOS prior to 26.4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Apple iOS 26.4, Apple iOS 18.7.7, Apple macOS Tahoe).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File): the Apple kernel writes sensitive memory contents into log entries without adequate redaction, allowing a local app to read those log entries and infer kernel memory layout or contents. Exploitation requires local access and user interaction (e.g., a user must run a malicious app), but no special privileges are needed. The fix, described by Apple as "improved data redaction," prevents sensitive kernel data from appearing in logs. The vulnerability was discovered and reported by Gor Aleksanyan, Dhiyanesh Selvaraj (@redroot97), and 이동하 (Lee Dong Ha of BoB 0xB6) (Apple iOS 26.4, Apple macOS Sequoia). No public proof-of-concept code has been identified.

Successful exploitation allows a malicious app to disclose kernel memory contents, compromising confidentiality of sensitive kernel-level data. There is no direct integrity or availability impact. While the vulnerability itself does not grant code execution, leaked kernel memory (such as kernel pointers or layout information) could be leveraged as a stepping stone to bypass ASLR or assist in chaining with other vulnerabilities for privilege escalation or deeper system compromise (Apple iOS 18.7.7, Apple macOS Tahoe).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, macOS Tahoe 26.4, visionOS 26.4, and watchOS 26.4. No configuration-based workaround is available; updating to a patched version is the only remediation. Users should also exercise caution when installing apps from untrusted sources, as exploitation requires running a malicious app (Apple iOS 18.7.7, Apple macOS Sequoia, Apple macOS Sonoma).

The vulnerability was covered as part of Apple's broader March 2026 security update, which addressed over 140 vulnerabilities across Apple platforms. Security news outlets such as CyberSecurityNews noted Apple's expansion of the iOS 18.7.7 update to additional devices in connection with the DarkSword exploit campaign, though CVE-2026-28868 itself is distinct from the DarkSword-related fixes. The CIS published an advisory noting multiple vulnerabilities in Apple products patched in this update cycle (CIS Advisory).