CVE-2026-28977: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-28977 Overview

CVE-2026-28977 is a memory safety vulnerability affecting multiple Apple operating systems. Processing a maliciously crafted file may trigger an out-of-bounds memory access, leading to unexpected application termination. Apple addressed the issue with improved bounds checks across its product lines. The flaw is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and requires local access with no user interaction or privileges.

Critical Impact

Attackers with local access can deliver a crafted file to cause denial of service through unexpected application termination on affected Apple devices.

Affected Products

• Apple iOS prior to 18.7.9 and 26.5, iPadOS prior to 18.7.9 and 26.5
• Apple macOS Sequoia prior to 15.7.7, Sonoma prior to 14.8.7, Tahoe prior to 26.5
• Apple tvOS, visionOS, and watchOS prior to 26.5

Discovery Timeline

• 2026-05-11 - CVE-2026-28977 published to the National Vulnerability Database
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-28977

Vulnerability Analysis

The vulnerability stems from improper bounds checking when Apple operating systems process certain file formats. When a maliciously crafted file is parsed, the affected component reads or writes outside the intended memory buffer. This out-of-bounds access corrupts process state and forces the consuming application to terminate unexpectedly.

The weakness is classified under [CWE-119], covering improper restriction of operations within the bounds of a memory buffer. Apple's advisories indicate the fix involved tightening bounds validation in the affected parsing logic. Exploitation produces a denial-of-service outcome rather than disclosing data or modifying it, consistent with availability-only impact.

Root Cause

The root cause is missing or insufficient bounds validation in a file-processing routine shared across Apple's platforms. The parser does not adequately validate length or offset fields embedded in input files. When values exceed expected ranges, the code accesses memory regions outside the allocated buffer. Apple corrected this by adding explicit bounds checks before the memory operation.

Attack Vector

Exploitation requires local delivery of a crafted file to the target device. The attack is local in scope and requires no authentication or user interaction beyond opening or processing the file through a vulnerable application. Successful exploitation terminates the targeted application, disrupting availability of the affected service.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is very low, reflecting limited likelihood of exploitation in the near term. Specific technical details about the vulnerable parser have not been published. Refer to the Apple Support Documents for vendor-provided context.

Detection Methods for CVE-2026-28977

Indicators of Compromise

• Unexpected application crashes on Apple devices when opening files received from untrusted sources
• Crash reports referencing out-of-bounds access or memory corruption signatures in system diagnostics
• Repeated termination of the same application correlated with specific file inputs

Detection Strategies

• Monitor macOS and iOS crash logs under ~/Library/Logs/DiagnosticReports/ for recurring abnormal terminations tied to file parsing
• Inspect mobile device management (MDM) telemetry for OS version compliance with patched releases
• Correlate user-reported application crashes with file delivery events from email, messaging, or web channels

Monitoring Recommendations

• Track OS build versions across the Apple fleet to identify devices still running pre-patch releases
• Centralize crash report collection from managed endpoints and alert on clustered failures within the same process
• Review file transfer logs for delivery of unusual or unexpected file types preceding crash events

How to Mitigate CVE-2026-28977

Immediate Actions Required

• Update affected devices to iOS 18.7.9 or 26.5, iPadOS 18.7.9 or 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5
• Enforce patch deployment through MDM platforms for managed Apple devices
• Communicate update requirements to users operating personal devices in BYOD environments

Patch Information

Apple has released fixes across its product lines as documented in Apple Support Document 127110, Apple Support Document 127111, Apple Support Document 127115, Apple Support Document 127116, Apple Support Document 127117, Apple Support Document 127118, Apple Support Document 127119, and Apple Support Document 127120. The patch introduces improved bounds checking in the affected file-processing logic.

Workarounds

• Avoid opening files from untrusted or unverified sources until patches are applied
• Restrict file delivery channels through email and messaging filters on enterprise gateways
• Use application sandboxing and least-privilege configurations to limit impact of unexpected termination