CVE-2026-28867

MEDIUM

iOS and iPadOS < 18.7.7 - Unauthenticated Kernel State Leak

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-28867. PoCs published by speedyfriend433.

AI-analyzed exploit summary This PoC exploits a macOS kernel information leak vulnerability (CVE-2026-28867) by abusing the `net.inet.tcp.info` sysctl to leak sensitive TCP connection state data, including sequence numbers (`tcpi_snd_nxt`, `tcpi_rcv_nxt`). The code demonstrates uninitialized memory disclosure in the kernel's TCP info structure.

Description

This issue was addressed with improved authentication. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to leak sensitive kernel state.

Exploits (1)

github WORKING POC

by speedyfriend433 · cpoc

https://github.com/speedyfriend433/CVE-2026-28867-PoC

View Code ZIP pw:eip

This PoC exploits a macOS kernel information leak vulnerability (CVE-2026-28867) by abusing the `net.inet.tcp.info` sysctl to leak sensitive TCP connection state data, including sequence numbers (`tcpi_snd_nxt`, `tcpi_rcv_nxt`). The code demonstrates uninitialized memory disclosure in the kernel's TCP info structure.

Classification

Working Poc 98%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: macOS kernel (version unspecified, but likely recent as of 2026)

No auth needed

Prerequisites: Local unprivileged access to the target macOS system · An existing TCP connection (local/remote IP and port must match an active connection)

MITRE ATT&CK

T1005 - Data from Local System T1552 - Unsecured Credentials

mistral-large-3 · analyzed Jul 05, 2026 Full analysis →