CVE-2026-28928: Apple iPadOS Use-After-Free Vulnerability

CVE-2026-28928 Overview

CVE-2026-28928 is a use-after-free vulnerability [CWE-416] affecting multiple Apple operating systems. Apple addressed the issue with improved memory management in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. A malicious application can trigger the flaw to cause unexpected system termination on the target device.

The vulnerability carries a CVSS 3.1 score of 9.8 and impacts the confidentiality, integrity, and availability of affected systems. While Apple's advisory highlights system termination as the observed impact, use-after-free conditions in operating system components frequently expand into memory corruption primitives useful for further exploitation.

Critical Impact
An app running on an affected Apple device can leverage this use-after-free condition to cause unexpected system termination and potentially compromise the memory state of the operating system.

Affected Products

Apple iOS and iPadOS versions prior to 26.6
Apple macOS Tahoe versions prior to 26.6
Apple tvOS and watchOS versions prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-28928 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-28928

Vulnerability Analysis

The issue is classified as a use-after-free [CWE-416] weakness in components shared across Apple's operating system families. Use-after-free bugs occur when code continues to reference memory after that memory has been released back to the allocator. Subsequent operations against the stale pointer can read attacker-influenced data, corrupt heap metadata, or redirect control flow.

Apple's advisory states the flaw allows an application to cause unexpected system termination. This behavior is consistent with a dereference of a dangling pointer that reaches a fault or an assertion within the affected subsystem. In many past Apple use-after-free vulnerabilities, similar primitives have been chained with heap-grooming techniques to escalate from a crash into arbitrary code execution.

Root Cause

The root cause is improper lifetime management of an object referenced by the vulnerable component. Apple's fix description indicates that the resolution was implemented through improved memory management, which typically means adjusting reference counting, adding explicit null checks after free, or restructuring object ownership to eliminate the race between object release and later dereference.

Attack Vector

An attacker delivers a malicious application to the target device through the App Store, sideloading channels, or enterprise deployment. Once executed, the application invokes the vulnerable code path with crafted inputs that trigger the use-after-free condition. The immediate result is unexpected system termination, denying service to the user. Exploitation does not require prior authentication on the device beyond installing and running the application.

No verified public proof-of-concept code is available for CVE-2026-28928. Refer to the Apple Support Article #128066, Apple Support Article #128067, Apple Support Article #128068, and Apple Support Article #128069 for vendor technical detail.

Detection Methods for CVE-2026-28928

Indicators of Compromise

Repeated unexpected system termination or kernel panic reports on iOS, iPadOS, macOS, tvOS, or watchOS devices tied to a specific application
Panic logs referencing memory access faults within the affected system frameworks
Installation of unsigned, sideloaded, or unfamiliar applications immediately preceding crash events

Detection Strategies

Collect and centrally analyze crash and panic reports from managed Apple endpoints for patterns indicating heap corruption or invalid memory access
Correlate application install events with subsequent system termination events on the same device
Monitor mobile device management (MDM) telemetry for devices running OS builds earlier than 26.6

Monitoring Recommendations

Track OS version compliance across the fleet and flag any Apple device running a version older than 26.6
Ingest crash logs into a centralized log platform to detect anomalies across multiple endpoints
Alert on new application installations from non-approved sources on managed corporate devices

How to Mitigate CVE-2026-28928

Immediate Actions Required

Update all Apple devices to iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, or watchOS 26.6 as applicable
Enforce update compliance through MDM policies and block enrollment of devices running vulnerable OS versions
Restrict installation of applications from unverified developers or non-App Store sources

Patch Information

Apple has released fixes in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. Patch details are available in Apple Support Article #128066, Apple Support Article #128067, Apple Support Article #128068, and Apple Support Article #128069.

Workarounds

No official vendor workaround exists; applying the vendor patch is the required remediation
Limit device exposure by restricting application installation privileges and enforcing allow-lists via MDM until patching is complete
Educate users to avoid installing applications from untrusted sources during the patch rollout window

bash

# Verify current Apple OS version before and after patching
# macOS
sw_vers -productVersion

# iOS/iPadOS (via MDM query or Settings)
# Settings > General > About > Software Version

# Expected post-patch value: 26.6 or later