Description

CVE-2026-28827 is a parsing issue in the handling of directory paths within macOS's NetFSFramework. According to Apple's advisory, the flaw could allow an app to break out of its sandbox. It was jointly credited to Csaba Fitzl (@theevilbit) of Iru and an anonymous researcher.

Impact

Exploitation of this vulnerability could allow a sandboxed app to escape its sandbox by exploiting improper path validation in NetFSFramework. Apple addressed the issue with improved path validation in macOS Tahoe 26.4.