CVE-2026-28857 — Vulnetix

CVE-2026-28857 PUBLISHED CVSS 6.5 MEDIUM

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.

EPSS 0.05% · 15.3th percentile

Risk Scores

CVSS 3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Score

0.05%

15.3th percentile

Affected Products

Vendor	Product	Versions
apple	macos	26.0
apple	ipados	0
apple	safari	0
Apple	visionOS	0
Apple	Safari	0
apple	visionos	0
Apple	macOS	0
Apple	iOS and iPadOS	0
apple	iphone_os	0

Exploit Intelligence

CIRCL seen: CVE-2026-28857 (circl-sighting)
CIRCL seen: CVE-2026-28857 (circl-sighting)
https://support.apple.com/en-us/126792 (circl)
https://support.apple.com/en-us/126794 (circl)
https://support.apple.com/en-us/126799 (circl)
https://support.apple.com/en-us/126800 (circl)
2026-03-20.json (github-poc)
2026-03-20.json (github-poc)
2026-03-20.json (github-poc)
2026-03-20.json (github-poc)

…and 73 more exploits

Timeline

Mar 25, 2026 CVE Published
Mar 25, 2026 EPSS Score
Mar 25, 2026 Coalition ESS Score
Mar 25, 2026 PoC Published
Mar 26, 2026 PoC Published
Mar 29, 2026 Security Advisory
Apr 22, 2026 Distribution Patch
Apr 22, 2026 Security Advisory
Apr 24, 2026 Distribution Patch
Apr 27, 2026 Distribution Patch
Apr 27, 2026 Security Advisory
Apr 28, 2026 Distribution Patch

References

https://support.apple.com/en-us/126793 advisory
https://support.apple.com/en-us/126794 advisory
https://support.apple.com/en-us/126798 advisory
https://support.apple.com/en-us/126800 advisory
https://support.apple.com/en-us/126796 advisory
https://support.apple.com/en-us/126792 advisory
https://support.apple.com/en-us/126795 advisory
https://support.apple.com/en-us/126799 advisory
https://support.apple.com/en-us/126797 advisory
https://support.apple.com/en-us/126801 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-28857 advisory

Open in Interactive Console →