---
id: CVE-2026-28876
title: >-
  A parsing issue in the handling of directory paths was addressed with improved
  path validation
summary: >-
  A parsing issue in the handling of directory paths was addressed with improved
  path validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4
  and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4,
  v…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: adp
vendor: Apple
product: iOS and iPadOS
affected:
  - ios_and_ipados < 18.7.7
  - ios_and_ipados < 26.4
  - macOS < 14.8.5
  - macOS < 15.7.5
  - macOS < 26.4
  - visionOS < 26.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-25T20:21:25.285151Z'
published: '2026-03-25'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T20:37:31.027Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-28876'
references:
  - url: 'https://support.apple.com/en-us/126792'
  - url: 'https://support.apple.com/en-us/126793'
  - url: 'https://support.apple.com/en-us/126794'
  - url: 'https://support.apple.com/en-us/126795'
  - url: 'https://support.apple.com/en-us/126796'
  - url: 'https://support.apple.com/en-us/126799'
tags:
  - cve.org
epss: 0.00487
epssPercentile: 0.41698
ingestedAt: '2026-10-27T16:11:58.922Z'
---

## Overview

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to access sensitive user data.

## Affected

- `ios_and_ipados < 18.7.7`
- `ios_and_ipados < 26.4`
- `macOS < 14.8.5`
- `macOS < 15.7.5`
- `macOS < 26.4`
- `visionOS < 26.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.