CVE-2026-28897: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-28897 Overview

CVE-2026-28897 is a buffer overflow vulnerability affecting multiple Apple operating systems, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw stems from insufficient input validation, allowing a local user to trigger unexpected system termination or read kernel memory contents. Apple addressed the issue across its product lines with improved input validation. The vulnerability is tracked under [CWE-121] Stack-based Buffer Overflow and requires local access for exploitation. No public proof-of-concept code or in-the-wild exploitation has been reported.

Critical Impact
A local attacker can crash affected Apple devices or disclose kernel memory, potentially enabling further exploitation chains targeting kernel address space layout randomization (KASLR) bypasses.

Affected Products

Apple iOS prior to 18.7.9 and iOS 26.5; Apple iPadOS prior to 18.7.9 and iPadOS 26.5
Apple macOS Sequoia prior to 15.7.7, macOS Sonoma prior to 14.8.7, and macOS Tahoe prior to 26.5
Apple tvOS prior to 26.5, visionOS prior to 26.5, and watchOS prior to 26.5

Discovery Timeline

2026-05-11 - CVE-2026-28897 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-28897

Vulnerability Analysis

CVE-2026-28897 is a buffer overflow rooted in inadequate boundary checking on user-supplied input processed within a privileged Apple operating system component. When a local process supplies a malformed or oversized input value, the affected routine writes beyond the bounds of an allocated buffer. This corruption can either crash the device by triggering a kernel panic or expose adjacent kernel memory contents to the calling process. The vulnerability is classified under [CWE-121] Stack-based Buffer Overflow.

The attack requires local access. An unprivileged user running code on the device can invoke the vulnerable code path without additional authentication or user interaction. Apple's advisory states the issue is fixed in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

Root Cause

The root cause is improper input validation before data is written into a fixed-size buffer. Apple's remediation notes confirm the fix involved adding improved input validation logic to reject or truncate oversized inputs before they reach the vulnerable copy operation.

Attack Vector

Exploitation requires a local foothold, such as a malicious application installed on the device or code executed through another vulnerability. Once running locally, an attacker invokes the vulnerable interface with crafted input. The resulting overflow can be tuned to either crash the system, denying availability, or to leak kernel memory bytes back to the attacker-controlled process. Memory disclosure is particularly useful as a primitive in multi-stage exploit chains aimed at bypassing kernel mitigations.

No verified exploitation code is publicly available. Refer to the Apple Support Article #127110 and related advisories for technical references.

Detection Methods for CVE-2026-28897

Indicators of Compromise

Unexpected kernel panics or system restarts on Apple devices, particularly clustered around the execution of a specific third-party application
Crash reports referencing memory access violations in kernel extensions or system services
Anomalous local processes invoking low-level system APIs at unusual frequencies

Detection Strategies

Collect and inspect crash logs from /Library/Logs/DiagnosticReports/ on macOS and from Settings > Privacy & Security > Analytics & Improvements on iOS and iPadOS
Correlate device crash telemetry with recently installed or updated applications to identify potential local triggers
Monitor mobile device management (MDM) inventories for devices running unpatched OS versions enumerated in the affected products list

Monitoring Recommendations

Enable centralized crash report collection through MDM solutions to surface kernel panics across the fleet
Track OS version compliance and flag any device not running the minimum patched version
Review application install events on managed devices for unsigned or sideloaded binaries that could host local exploitation code

How to Mitigate CVE-2026-28897

Immediate Actions Required

Update all Apple devices to the patched versions: iOS 18.7.9, iPadOS 18.7.9, iOS/iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5
Enforce update compliance through MDM policies and block enrollment of devices running unpatched versions
Audit installed applications and remove untrusted or unnecessary third-party software that could deliver local exploit code

Patch Information

Apple released coordinated updates across its operating system portfolio. Patch details are published in the following advisories: Apple Support Article #127110, Apple Support Article #127111, Apple Support Article #127115, Apple Support Article #127116, Apple Support Article #127117, Apple Support Article #127118, Apple Support Article #127119, and Apple Support Article #127120.

Workarounds

No vendor-supplied workaround exists; apply the security update as the primary remediation
Restrict installation of untrusted applications using MDM application allowlists and Apple's Lockdown Mode where appropriate
Limit physical and local access to managed devices to reduce opportunities for local exploitation

bash

# Verify patched OS version on macOS
sw_vers -productVersion

# Force MDM-managed update on macOS (Jamf example)
sudo softwareupdate -i -a -R

# Check iOS/iPadOS version via MDM query (generic)
# Inventory > Operating System > Version >= 18.7.9 or >= 26.5