CVE-2026-28886: Apple iPadOS DoS Vulnerability

CVE-2026-28886 Overview

CVE-2026-28886 is a null pointer dereference vulnerability [CWE-476] affecting multiple Apple operating systems. An attacker in a privileged network position can trigger the flaw to cause a denial-of-service condition on affected devices. Apple addressed the issue through improved input validation across its operating system family, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability requires network adjacency and no user interaction, but exploitation complexity is high. No public proof-of-concept code or exploitation in the wild has been reported.

Critical Impact
A network-adjacent attacker can trigger a null pointer dereference to crash affected Apple devices, resulting in denial-of-service availability loss.

Affected Products

Apple iOS and iPadOS (prior to 18.7.7 and 26.4)
Apple macOS Sequoia (prior to 15.7.5), Sonoma (prior to 14.8.5), Tahoe (prior to 26.4)
Apple tvOS, visionOS, and watchOS (prior to 26.4)

Discovery Timeline

2026-03-25 - CVE-2026-28886 published to the National Vulnerability Database
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-28886

Vulnerability Analysis

The flaw is a null pointer dereference in a network-reachable component shared across Apple's operating systems. When the vulnerable code path processes malformed input from a network peer, it fails to validate a pointer before dereferencing it. The resulting access to a null address causes the affected process or kernel subsystem to crash.

The attacker must occupy a privileged network position, such as a man-in-the-middle on the same local segment or an upstream router. This positioning requirement, combined with timing or protocol-state preconditions, raises the attack complexity. Successful exploitation produces a denial-of-service condition only — there is no confidentiality or integrity impact.

Apple's fix introduces improved input validation to ensure the relevant pointer is checked before use. The patched releases are iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4.

Root Cause

The root cause is missing validation of a pointer derived from attacker-influenced network input. The code path assumed a non-null result from an upstream parsing or lookup step. When a crafted packet causes that step to return null, the subsequent dereference triggers a fault and terminates the affected component.

Attack Vector

Exploitation requires network access and a privileged position relative to the target. No authentication or user interaction is required. The attacker delivers a malformed protocol message that reaches the vulnerable handler, causing the device to crash or the affected service to become unresponsive. Repeated delivery can sustain the denial-of-service state.

No verified proof-of-concept code is publicly available. Technical specifics of the affected component were not disclosed in the advisory. Consult the Apple Security Advisories for vendor-published details.

Detection Methods for CVE-2026-28886

Indicators of Compromise

Unexpected reboots, kernel panics, or service restarts on Apple endpoints coinciding with network activity from untrusted peers
Repeated crash reports referencing the same network-facing subsystem in /Library/Logs/DiagnosticReports/ on macOS
Anomalous malformed protocol traffic originating from devices on the same broadcast domain or upstream network path

Detection Strategies

Monitor endpoint crash and panic logs for clustered failures across multiple Apple devices in the same network segment
Inspect network telemetry for malformed packets targeting Apple devices, particularly from devices in privileged positions such as gateways or Wi-Fi access points
Correlate device availability dips with the presence of new or unauthorized hosts on local subnets

Monitoring Recommendations

Centralize macOS, iOS, and iPadOS diagnostic logs through your MDM or telemetry pipeline for cross-device crash analysis
Track operating system version inventory to identify endpoints still running pre-patch builds
Alert on rogue DHCP, ARP, or router advertisement activity that could establish the privileged network position required for exploitation

How to Mitigate CVE-2026-28886

Immediate Actions Required

Update all Apple devices to the patched operating system versions: iOS/iPadOS 18.7.7 or 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4
Prioritize devices connected to untrusted or shared networks, including mobile fleets and remote workers on public Wi-Fi
Enforce update compliance through MDM policies and verify installation across managed inventory

Patch Information

Apple has released fixes in iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. Refer to the relevant vendor advisories: Apple Security Advisory #126792, #126793, #126794, #126795, #126796, #126797, #126798, and #126799.

Workarounds

Restrict device use on untrusted networks until the patch is applied; prefer trusted wired networks or VPN-tunneled connections
Segment Apple endpoints from untrusted hosts using VLANs, client isolation on Wi-Fi, and firewall rules at the network edge
Disable or filter the affected protocol at network boundaries if it is not required for business operations

bash

# Verify patched OS version on macOS
sw_vers -productVersion

# Example MDM compliance check (pseudocode)
# Flag devices running versions below the patched builds
# macOS: < 14.8.5, < 15.7.5, < 26.4
# iOS/iPadOS: < 18.7.7, < 26.4