CVE-2026-28918: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-28918 Overview

CVE-2026-28918 is an out-of-bounds read vulnerability [CWE-125] affecting multiple Apple operating systems. The flaw exists in file parsing logic where insufficient bounds checking allows a maliciously crafted file to trigger memory access outside allocated buffers. Successful exploitation results in unexpected application termination, producing a denial-of-service condition on the targeted device.

Apple addressed the issue by adding improved bounds checking in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. The attack requires user interaction, typically opening or previewing the malicious file. No public proof-of-concept code or in-the-wild exploitation has been reported.

Critical Impact
Parsing a maliciously crafted file can cause an unexpected app termination across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS devices.

Affected Products

Apple iOS and iPadOS (versions prior to 26.5)
Apple macOS Tahoe (versions prior to 26.5)
Apple tvOS, visionOS, and watchOS (versions prior to 26.5)

Discovery Timeline

2026-05-11 - CVE-2026-28918 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28918

Vulnerability Analysis

The vulnerability is classified under [CWE-125] Out-of-Bounds Read. When the affected component parses a file, it fails to validate that read operations remain within the bounds of the allocated buffer. A crafted file can manipulate length fields, offsets, or structural metadata so that the parser dereferences memory beyond the intended region.

The resulting access violation causes the process to terminate. The vulnerability does not appear to provide a path to code execution or data disclosure based on Apple's advisory, which describes the impact as unexpected app termination. The CWE-125 classification and availability-only impact align with a parser reading past buffer boundaries and triggering a fault.

Root Cause

The root cause is missing or insufficient bounds checking in the file parsing routine. The parser trusts length or offset values embedded in the file without verifying them against the actual buffer size. Apple's fix addresses this by adding explicit bounds validation before memory access operations.

Attack Vector

Exploitation requires an attacker to deliver a maliciously crafted file to a target user and convince that user to open it. Delivery channels include email attachments, messaging applications, web downloads, or AirDrop. Once the file is parsed by the vulnerable component, the application handling it terminates unexpectedly.

No verified exploit code is publicly available for CVE-2026-28918. The vulnerability mechanism involves a parser dereferencing memory beyond an allocated buffer when processing attacker-controlled structural fields in the file format. Refer to the Apple Support advisories for component-specific details.

Detection Methods for CVE-2026-28918

Indicators of Compromise

Unexpected and repeated application crashes correlated with opening files from untrusted sources
Crash reports in ~/Library/Logs/DiagnosticReports/ on macOS or device crash logs on iOS referencing parsing components
Inbound files with malformed headers or anomalous length fields delivered via email, messaging, or web

Detection Strategies

Monitor endpoint crash telemetry for spikes in application termination events tied to file-handling processes
Correlate file delivery events (email gateway, web proxy) with subsequent application crashes on the receiving endpoint
Inspect operating system version inventory to identify devices running pre-26.5 builds that remain exposed

Monitoring Recommendations

Centralize macOS and iOS crash diagnostics into your SIEM or data lake for trend analysis
Alert on repeated crashes of the same application across multiple users, which can indicate a targeted malicious file campaign
Track patch compliance for Apple OS updates and flag endpoints lagging behind the 26.5 baseline

How to Mitigate CVE-2026-28918

Immediate Actions Required

Update affected devices to iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5
Inventory all Apple endpoints and prioritize updates for devices that regularly process files from external sources
Educate users to avoid opening files from untrusted senders until patching is complete

Patch Information

Apple released fixes in the 26.5 release train across all affected platforms. Patch details are available in Apple Support Article #127110, Article #127115, Article #127118, Article #127119, and Article #127120. Apply the relevant update for each platform via Software Update.

Workarounds

Restrict acceptance of files from untrusted sources at email and messaging gateways until patches are applied
Disable automatic file previews where supported to reduce parser exposure to untrusted content
Enforce mobile device management (MDM) policies that require minimum OS versions for corporate access

bash

# Verify macOS version meets the patched baseline
sw_vers -productVersion

# Trigger software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart