CVE-2026-28846 — Vulnetix

CVE-2026-28846 PUBLISHED CVSS 9.300000190734863 CRITICAL

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected app termination.

EPSS 0.18% · 40.0th percentile

Risk Scores

CVSS 4.0

9.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.18%

40.0th percentile

Affected Products

Vendor	Product	Versions
Apple	tvOS	0
Apple	iOS and iPadOS	0, 0
Apple	macOS	0, 0, 0
Apple	watchOS	0
Apple	visionOS	0

Exploit Intelligence

https://support.apple.com/en-us/127110 (circl)
https://support.apple.com/en-us/127111 (circl)
https://support.apple.com/en-us/127115 (circl)
https://support.apple.com/en-us/127116 (circl)
https://support.apple.com/en-us/127117 (circl)
https://support.apple.com/en-us/127118 (circl)
https://support.apple.com/en-us/127119 (circl)
https://support.apple.com/en-us/127120 (circl)

Timeline

May 11, 2026 CVE Published
May 12, 2026 Security Advisory
May 18, 2026 EPSS Score
May 19, 2026 EPSS Score
May 20, 2026 EPSS Score
May 21, 2026 EPSS Score
May 22, 2026 EPSS Score
May 23, 2026 EPSS Score
May 24, 2026 EPSS Score
May 25, 2026 EPSS Score
May 26, 2026 EPSS Score
May 27, 2026 EPSS Score

References

Open in Interactive Console →