Product:
iOS, iPadOS, macOS, tvOS, visionOS, watchOS
Summary
An out-of-bounds read was addressed with improved bounds checking. This issue may allow an app to cause a denial-of-service. The problem has been fixed in the latest versions of Apple’s operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-28991 |
Exploitation
To exploit this vulnerability, an attacker could craft a malicious application that triggers the out-of-bounds read condition. By sending specially crafted network requests to the affected device, the attacker may cause the application to crash, leading to a denial-of-service situation.
Affected Products
- iOS 26.5: Latest version with improved bounds checking to prevent out-of-bounds reads.
- iPadOS 26.5: Updated to address the same vulnerability as iOS.
- macOS Tahoe 26.5: Includes fixes for the out-of-bounds read issue.
- tvOS 26.5: Updated to mitigate the vulnerability.
- visionOS 26.5: Enhanced security to prevent exploitation.
- watchOS 26.5: Fixed the out-of-bounds read issue.
Mitigation
Users are advised to update their devices to the latest versions of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to mitigate the risk associated with this vulnerability. Regularly updating software can help protect against known vulnerabilities.