Talos Vulnerability Report

Summary

A information disclosure vulnerability exists in the CoreWLAN functionality of macOS (version(s): 26.3.1(25D2128)). A specially crafted API call can lead to information disclosure. An attacker can call a sequence of APIs to trigger this vulnerability.

Confirmed Vulnerable Versions

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

macOS (version(s): 26.3.1(25D2128))

Product URLs

macOS - https://apple.com

CVSSv3 Score

3.3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-912 - Hidden Functionality

Details

macOS is the operating system designed by Apple for their line of Mac computers, providing a graphical user interface and managing system resources and hardware.

The macOS CoreWLAN framework exposes wireless interface APIs, including the CWNetworkProfile class. These APIs are accessible to regular user processes and do not require special entitlements or permissions.

Apple’s public documentation for CWNetworkProfile lists only:

• security: CWSecurity - the network security mode (for example Open, WEP, WPA2/WPA3 Personal).
• ssid: String? - the Wi-Fi network name.
• ssidData: Data? - the same SSID value in raw byte form.

Listing preferred SSIDs is already possible with: networksetup -listpreferredwirelessnetworks <interface name> and is not, by itself, considered sensitive.

The issue is that additional undocumented/private properties are still accessible through KVC valueForKey: and by locally declaring those properties in a category and reading them through normal getter or dot syntax.

The most relevant undocumented CWNetworkProfile fields for this issue are:

• lastConnected: NSDate - timestamp of the most recent connection to that profile.
• bssidList: NSArray - list of BSSID records associated with that profile.

These fields significantly increase the privacy impact of the exposed data: lastConnected reveals the latest time each network profile was used, while bssidList is the highest-impact source because each element corresponds to one BSSID associated with that profile and can contain:

• AssociatedAt: Date - apparently the last time this specific BSSID was associated.
• BSSID: String - identifier of the specific Wi-Fi interface associated with that record.
• LocationAccuracy: Number - apparently a location-accuracy value, likely in meters.
• LocationLatitude: Number - latitude linked to that BSSID observation.
• LocationLongitude: Number - longitude linked to that BSSID observation.
• LocationTimestamp: Date - time when that location sample was recorded.

bssidList is likely intended to support multi-AP/multi-band deployments for a single SSID, but in practice each element gives a geolocated observation point. By iterating every profile and every bssidList entry, a low-privileged local process can reconstruct a historical location map of where the device (and therefore likely the user) has been, with timestamps and accuracy estimates. Combined with lastConnected, this also allows inference of very recent, and sometimes current, location context.

For comparison, similar data can be read from system preferences with sudo defaults read /Library/Preferences/com.apple.wifi.known-networks. A simplified example output:

[...]
"wifi.network.ssid.<SSID_NAME>" = {
    [...]
    AddedAt = "<TIMESTAMP_ADDED>";
    BSSList = (
        {
            BSSID = "<BSSID_1>";
            LastAssociatedAt = "<TIMESTAMP_1>";
            Channel = 11;
            Location = {
                LocationAccuracy = 40;
                LocationLatitude = "<LATITUDE_1>";
                LocationLongitude = "<LONGITUDE_1>";
                LocationTimestamp = "<TIMESTAMP_1>";
            };
        },
        {
            BSSID = "<BSSID_2>";
            LastAssociatedAt = "<TIMESTAMP_2>";
            Channel = 6;
            Location = {
                LocationAccuracy = 40;
                LocationLatitude = "<LATITUDE_2>";
                LocationLongitude = "<LONGITUDE_2>";
                LocationTimestamp = "<TIMESTAMP_2>";
            };
        },
        [...]
    );
    [...]
    JoinedBySystemAt = "<TIMESTAMP>";
    JoinedByUserAt = "<TIMESTAMP>";
    [...]
    SSID = "<SSID_NAME>";
    [...]
    LastDisconnectTimestamp = "<TIMESTAMP>";
    [...]
};
[...]

This command requires both root privileges and Full Disk Access. The CoreWLAN access path does not, however, require root privileges or Full Disk Access and still exposes location-history data to a low-privilege user process without special entitlements or permissions.

Vendor Response (No CVE Assigned)

Vendor Link: https://developer.apple.com/documentation/macos-release-notes/macos-27-release-notes

Vendor Notes: Fixed in the macOS 27 release. Addressed this issue with defense-in-depth enhancements. No CVE assigned.

Timeline

2026-04-02 - Initial Vendor Contact
2026-04-02 - Vendor Disclosure
2026-09-14 - Vendor Patch Release
2026-09-14 - Public Release