CVE-2026-28918

MEDIUM

iOS and iPadOS < 26.5 - Out-of-bounds Read via Maliciously Crafted File

Title source: llm
STIX 2.1

Description

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.

References (5)

Core 5

Scores

CVSS v3 6.5
EPSS 0.0005
EPSS Percentile 16.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-125 CWE-787
Status published
Products (11)
Apple/iOS and iPadOS < 26.5
apple/ipados < 26.5
apple/iphone_os < 26.5
Apple/macOS < 26.5
apple/macos 26.0 - 26.5
Apple/tvOS < 26.5
apple/tvos < 26.5
Apple/visionOS < 26.5
apple/visionos < 26.5
Apple/watchOS < 26.5
... and 1 more
Published May 11, 2026
Tracked Since May 12, 2026