CVE-2026-28935: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-28935 Overview

CVE-2026-28935 is a memory handling vulnerability affecting multiple Apple operating systems. A malicious application can trigger unexpected system termination or corrupt kernel memory. Apple addressed the flaw with improved memory handling across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability is classified under [CWE-119], indicating improper restriction of operations within the bounds of a memory buffer.

The issue affects the integrity of kernel memory, which is the most privileged execution context on Apple devices. Successful exploitation can destabilize the kernel or serve as a primitive for further compromise chains.

Critical Impact
A local application can corrupt kernel memory or force unexpected system termination, potentially enabling privilege escalation when chained with additional flaws.

Affected Products

Apple iOS (fixed in iOS 26.6.1) and iPadOS (fixed in iPadOS 26.6.1)
Apple macOS Sequoia (fixed in 15.8) and macOS Tahoe (fixed in 26.6.2)
Apple tvOS 27, visionOS 27, and watchOS 27

Discovery Timeline

2026-09-14 - CVE-2026-28935 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-28935

Vulnerability Analysis

The flaw is a memory corruption issue within Apple's kernel code paths. According to Apple's advisories, the issue was addressed through improved memory handling. An app running on the device can trigger the condition to corrupt kernel memory or cause an unexpected system termination.

Memory corruption bugs at the kernel level are high-value targets for attackers. They frequently serve as the second stage in exploit chains that begin with a sandboxed process and end with full device compromise. The flaw falls under [CWE-119], covering improper restriction of memory buffer operations.

Root Cause

Apple has not published detailed root-cause information. The vendor advisories indicate the underlying issue was resolved by improving how memory is handled in the affected kernel component. This language typically signals a buffer boundary error, a validation gap, or an object lifetime issue that allowed writes beyond an intended memory region.

Attack Vector

Exploitation requires a malicious application executing on the target device. The application invokes the vulnerable kernel interface with crafted inputs, causing the kernel to mishandle memory. The result is either a kernel panic (denial of service) or corruption of adjacent kernel structures. Attackers targeting this class of bug typically deliver the malicious app through side-loading, developer channels, or a compromised legitimate application.

No public proof-of-concept or exploit code is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available for CVE-2026-28935.
Refer to the Apple security advisories for authoritative technical detail.

Detection Methods for CVE-2026-28935

Indicators of Compromise

Unexpected kernel panics or system reboots on Apple devices, especially recurring events tied to a specific application
Crash reports in /Library/Logs/DiagnosticReports/ referencing kernel subsystems after launching a suspect application
Installation of applications from outside the App Store on managed devices where side-loading is not authorized

Detection Strategies

Correlate device crash telemetry from Mobile Device Management (MDM) platforms to identify clusters of kernel terminations following specific app installs
Inspect macOS system.log and unified logs for repeated panic entries or Mach exceptions tied to a userland process
Baseline application inventories on managed endpoints and flag unsigned or newly introduced binaries preceding stability incidents

Monitoring Recommendations

Forward Apple endpoint crash and diagnostic logs into a centralized SIEM for pattern analysis across the fleet
Track OS build versions across enrolled devices and alert on hosts still running pre-patch releases
Monitor for out-of-policy application installation events on iOS, iPadOS, and macOS through MDM compliance rules

How to Mitigate CVE-2026-28935

Immediate Actions Required

Upgrade all Apple devices to the fixed builds: iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27
Enforce automatic updates through MDM for iOS, iPadOS, and macOS fleets
Audit installed applications and remove any unsigned or unverified apps from managed devices

Patch Information

Apple has published patched builds through its standard software update channels. Consult the vendor advisories for platform-specific release notes: Apple Support Advisory #148281, Apple Support Advisory #148282, Apple Support Advisory #149036, Apple Support Advisory #149037, Apple Support Advisory #149038, and Apple Support Advisory #149043.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation
Restrict application installation to the App Store and vetted enterprise sources until devices are updated
Disable developer mode and side-loading on managed iOS and iPadOS devices via configuration profiles

bash

# Verify current macOS build after patching
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate --install --all --restart