CVE-2026-28858

CRITICAL

Apple Ios And Ipados < 26.4 - Buffer Overflow

Title source: rule

Description

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

Exploits (1)

nomisec WRITEUP

by kaleth4 · poc

https://github.com/kaleth4/CVE-2026-28858

View Code ZIP pw:eip

References (1)

https://support.apple.com/en-us/126792

Scores

CVSS v3 9.8

EPSS 0.0014

EPSS Percentile 33.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-120

Status published

Products (3)

Apple/iOS and iPadOS < 26.4

apple/ipados < 26.4

apple/iphone_os < 26.4

Published Mar 25, 2026

Tracked Since Mar 25, 2026