CVE-2026-28995

HIGH

iOS and iPadOS < 18.7.9 - Sandbox Escape via Logic Issue

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-28995. PoCs published by Robertmak2014-sudow.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2026-28995, a path traversal vulnerability in Apple's App Intents framework on iOS 26.4.2 and below. The exploit allows reading arbitrary files outside the app sandbox by leveraging insufficient path validation.

Description

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox.

Exploits (1)

github WORKING POC

by Robertmak2014-sudow · swiftpoc

https://github.com/Robertmak2014-sudow/CVE-2026-28995

View Code ZIP pw:eip

This repository contains a functional proof-of-concept for CVE-2026-28995, a path traversal vulnerability in Apple's App Intents framework on iOS 26.4.2 and below. The exploit allows reading arbitrary files outside the app sandbox by leveraging insufficient path validation.

Classification

Working Poc 98%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: iOS App Intents framework (iOS 26.4.2 and below)

No auth needed

Prerequisites: iOS device running version 26.4.2 or earlier · Ability to install and run an app with App Intents

MITRE ATT&CK

T1005 - Data from Local System T1552 - Unsecured Credentials

mistral-large-3 · analyzed Jul 03, 2026 Full analysis →

References (6)

Core 6

Core References

https://support.apple.com/en-us/127110

https://support.apple.com/en-us/127111

https://support.apple.com/en-us/127115

https://support.apple.com/en-us/127118

https://support.apple.com/en-us/127119

https://support.apple.com/en-us/127120

Scores

CVSS v3 8.8

EPSS 0.0012

EPSS Percentile 2.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-269

Status published

Products (12)

Apple/iOS and iPadOS < 18.7.9

Apple/iOS and iPadOS < 26.5

apple/ipados < 18.7.9

apple/iphone_os < 18.7.9

Apple/macOS < 26.5

apple/macos 26.0 - 26.5

Apple/tvOS < 26.5

apple/tvos < 26.5

Apple/visionOS < 26.5

apple/visionos < 26.5

... and 2 more

Published May 11, 2026

Tracked Since May 12, 2026