Product:
iOS and iPadOS
Summary
A resource exhaustion issue was addressed with improved input validation. This issue may allow a remote attacker to cause a denial-of-service. The vulnerability has been fixed in the latest versions of iOS and iPadOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-28872 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted network requests to the affected devices. If successful, this can lead to resource exhaustion, resulting in a denial-of-service condition. The attack does not require any user interaction or special privileges.
Affected Products
- iOS 18.7.9 – Fixed resource exhaustion issue with improved input validation.
- iPadOS 18.7.9 – Addressed the same vulnerability as in iOS.
- iOS 26.4 – Updated version that resolves the issue.
- iPadOS 26.4 – Contains the fix for the resource exhaustion vulnerability.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of iOS and iPadOS. Regularly applying updates can help protect against known vulnerabilities and improve overall security.