CVE-2026-28966: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-28966 Overview

CVE-2026-28966 is an out-of-bounds write vulnerability [CWE-787] affecting multiple Apple operating systems. Processing a maliciously crafted file may lead to unexpected app termination. Apple addressed the flaw with improved bounds checking across iOS, iPadOS, macOS, tvOS, and visionOS.

The vulnerability requires user interaction, typically opening or previewing a crafted file. Successful exploitation impacts application availability without direct effects on confidentiality or integrity based on the published CVSS metrics.

Critical Impact
A remote attacker can trigger application termination on unpatched Apple devices by delivering a maliciously crafted file that a user opens or processes.

Affected Products

Apple iOS and iPadOS (fixed in iOS 26.7 / iPadOS 26.7 and iOS 27 / iPadOS 27)
Apple macOS (fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27)
Apple tvOS 27 and Apple visionOS 27

Discovery Timeline

2026-09-14 - CVE-2026-28966 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-28966

Vulnerability Analysis

CVE-2026-28966 is an out-of-bounds write condition in file parsing logic shared across Apple's operating systems. When the vulnerable component processes a crafted file, it writes data past the intended memory boundary of an allocated buffer. The resulting corruption forces the application to terminate.

Apple's advisories state the fix was implemented through improved bounds checking. This indicates the root cause was insufficient validation of a length or offset field used during buffer writes. The consistency of the fix across iOS, iPadOS, macOS, tvOS, and visionOS points to shared framework code, likely in a media or document parser.

The published metrics indicate no observed impact on confidentiality or integrity, and no known exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or insufficient bounds validation prior to a memory write during file processing. An attacker-controlled field in the input file drives a write outside the allocated buffer. Apple's remediation applies stricter checks before writing, preventing the out-of-bounds access.

Attack Vector

Exploitation requires delivering a malicious file to a target and inducing the user to open or preview it. Common delivery channels include email attachments, messaging apps, and web downloads. Because the affected code is shared across Apple platforms, the same crafted file can affect multiple device types.

No public proof-of-concept code is available. Apple has not attributed the report to a named researcher in the referenced advisories. Refer to Apple advisories 149034, 149035, 149036, 149038, 149041, 149042, and 149043 for platform-specific component details.

Detection Methods for CVE-2026-28966

Indicators of Compromise

Repeated unexpected termination of a specific application shortly after opening an attachment or downloaded file.
Crash reports in ~/Library/Logs/DiagnosticReports/ on macOS referencing out-of-bounds write or heap corruption in a file parser.
Delivery of unusual file types from untrusted senders across email, iMessage, or AirDrop.

Detection Strategies

Correlate application crash telemetry with recent file open events to identify potentially malicious inputs.
Inspect mobile device management (MDM) inventory to identify endpoints running Apple OS versions prior to the fixed builds.
Retain and analyze diagnostic reports for repeated crashes in the same framework or process across multiple users.

Monitoring Recommendations

Monitor endpoints for iOS, iPadOS, macOS, tvOS, and visionOS builds below the versions listed in the affected products section.
Alert on high-volume delivery of the same attachment to multiple users, which may indicate targeted file-based delivery.
Track patch adoption rates across the fleet and prioritize devices used by high-risk personnel.

How to Mitigate CVE-2026-28966

Immediate Actions Required

Update all Apple devices to the fixed versions: iOS 26.7 / iPadOS 26.7, iOS 27 / iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, or visionOS 27.
Enforce update deployment through MDM policies to ensure managed devices receive the patch promptly.
Advise users to avoid opening unexpected files from untrusted sources until updates are applied.

Patch Information

Apple has published patches for all affected platforms. Consult the corresponding Apple Support documents for exact build numbers and installation instructions: Apple Support Document #149034, #149035, #149036, #149038, #149041, #149042, and #149043.

Workarounds

No official workaround has been published by Apple; applying the vendor patches is the only supported remediation.
Restrict inbound file types via email and messaging gateways where feasible, particularly from external senders.
Educate users on the risk of opening unsolicited attachments and previewing files from unknown sources.

bash

# Verify current macOS build against the fixed versions
sw_vers

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart