CVE-2026-28872 Overview
CVE-2026-28872 is a resource exhaustion vulnerability affecting Apple iOS and iPadOS. A remote attacker can trigger a denial-of-service condition by sending crafted network input that the operating system fails to validate properly. Apple addressed the flaw with improved input validation in iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, and iPadOS 26.4. The weakness is classified under CWE-400, Uncontrolled Resource Consumption. No authentication or user interaction is required to exploit the issue across the network.
Critical Impact
A remote, unauthenticated attacker can render affected iPhone and iPad devices unavailable through resource exhaustion, disrupting device availability without leaking data or modifying system state.
Affected Products
- Apple iOS prior to 18.7.9
- Apple iPadOS prior to 18.7.9
- Apple iOS prior to 26.4 and iPadOS prior to 26.4
Discovery Timeline
- 2026-05-11 - CVE-2026-28872 published to the National Vulnerability Database (NVD)
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-28872
Vulnerability Analysis
The vulnerability stems from insufficient input validation in components reachable over the network on iOS and iPadOS. An attacker supplies malformed or oversized input that the affected component processes without proper bounds or rate enforcement. The processing path consumes excessive memory, CPU, or other finite system resources, leading to a denial-of-service condition. The flaw does not impact confidentiality or integrity. Availability is the sole affected security property, consistent with the CWE-400 classification published by Apple in support documents 126792 and 127111.
Root Cause
Apple's advisories attribute the root cause to inadequate validation of attacker-controlled input prior to resource allocation. The vendor fix introduces stricter input validation that rejects or constrains malformed input before downstream processing can exhaust system resources. Apple has not disclosed the specific framework, daemon, or protocol parser involved.
Attack Vector
Exploitation occurs over the network with low complexity and no required privileges or user interaction. An attacker with the ability to send traffic to a vulnerable device can repeatedly submit crafted requests to trigger resource consumption. The Exploit Prediction Scoring System (EPSS) currently places the probability of exploitation at 0.123% as of 2026-05-17. No public proof-of-concept exploit code, exploit database entry, or CISA Known Exploited Vulnerabilities listing is available at the time of publication.
No verified exploitation code is available. Refer to the Apple security advisories for the authoritative technical description.
Detection Methods for CVE-2026-28872
Indicators of Compromise
- Unexpected reboots, kernel panics, or unresponsive UI on iOS or iPadOS devices running versions prior to 18.7.9 or 26.4
- Sustained high CPU or memory consumption attributed to system networking daemons on mobile endpoints
- Repeated inbound network requests from a single source to a managed iOS or iPadOS device followed by loss of connectivity
Detection Strategies
- Inventory managed iPhone and iPad fleets through mobile device management (MDM) and flag devices reporting OS versions earlier than iOS/iPadOS 18.7.9 or 26.4
- Correlate network telemetry from firewalls and NDR sensors for anomalous traffic volume directed at mobile device IP ranges
- Monitor MDM health attestation events for device unavailability or repeated reconnections consistent with denial-of-service triggers
Monitoring Recommendations
- Enable logging of inbound connections to corporate Wi-Fi segments hosting mobile devices and alert on traffic patterns targeting common iOS service ports
- Track Apple security advisory feeds for updates to Apple Support Document #126792 and Apple Support Document #127111
- Set MDM compliance policies to surface devices that fall behind on patch level and report them to the SOC for follow-up
How to Mitigate CVE-2026-28872
Immediate Actions Required
- Update all iPhone devices to iOS 18.7.9 or iOS 26.4 and iPad devices to iPadOS 18.7.9 or iPadOS 26.4
- Push the update through MDM with an enforced compliance deadline for managed fleets
- Restrict exposure of mobile devices to untrusted networks until the patch is applied
Patch Information
Apple released fixes in iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, and iPadOS 26.4. The patch introduces improved input validation that prevents the resource exhaustion path. Details are documented in Apple Support Document #126792 and Apple Support Document #127111.
Workarounds
- Place vulnerable devices on segmented Wi-Fi networks with egress and ingress filtering until patched
- Disable or limit reachability of network-facing services on mobile devices where supported by configuration profiles
- Require VPN-only connectivity for managed devices to reduce direct network exposure to untrusted sources
# Example MDM compliance check using Apple Configurator / mdmclient on macOS host inspecting tethered device
# Verify the target iOS/iPadOS build meets the patched version baseline
ideviceinfo -k ProductVersion | awk -F. '{ if (($1>26) || ($1==26 && $2>=4) || ($1==18 && $2==7 && $3>=9)) print "PATCHED"; else print "VULNERABLE" }'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
