Information disclosure in macOS - CVE-2026-28870

Vulnerability identifier: #VU124387

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-28870

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access controls in GeoServices when handling local application requests. A local user can exploit this to disclose sensitive information.

Access to the local system is required to exploit this vulnerability.

macOS
iPadOS
Apple iOS
tvOS
visionOS
watchOS

Install update from vendor's website.

macOS - update to 26.4 25E246
iPadOS - addressed in versions 18.7.9 22H355, 26.4 23E246
Apple iOS - addressed in versions 18.7.9 22H355, 26.4 23E246
tvOS - update to 26.4 23L243
visionOS - update to 26.4
watchOS - update to 26.4 23T240

• https://support.apple.com/en-us/126794

• Multiple vulnerabilities in Apple macOS Tahoe
• Multiple vulnerabilities in Apple iOS 26 and iPadOS 26
• Multiple vulnerabilities in Apple tvOS
• Multiple vulnerabilities in Apple watchOS
• Multiple vulnerabilities in Apple visionOS
• Multiple vulnerabilities in Apple iOS 18 and iPadOS 18