CVE-2026-28985: Apple iPadOS DoS Vulnerability

CVE-2026-28985 Overview

CVE-2026-28985 is a null pointer dereference vulnerability [CWE-476] affecting multiple Apple operating systems. An attacker on the local network can trigger the flaw to cause a denial-of-service condition on vulnerable devices. Apple addressed the issue through improved input validation in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and tvOS 26.5. The vulnerability requires no authentication and no user interaction. Exploitation impacts device availability but does not compromise confidentiality or integrity.

Critical Impact
A local network attacker can crash Apple devices by sending crafted input that triggers a null pointer dereference, resulting in service disruption across iOS, iPadOS, macOS Tahoe, and tvOS endpoints.

Affected Products

Apple iOS (prior to 26.5)
Apple iPadOS (prior to 26.5)
Apple macOS Tahoe (prior to 26.5)
Apple tvOS (prior to 26.5)

Discovery Timeline

2026-05-11 - CVE-2026-28985 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28985

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-476] in an unspecified component shared across Apple operating systems. When the affected component processes input from the local network, it fails to validate that a pointer is non-null before dereferencing it. The resulting access to address zero causes a process crash or kernel panic, depending on the component's privilege level. Apple resolved the flaw by adding input validation that rejects malformed data before the dereference occurs. The Apple security advisories describe the impact as a denial-of-service triggered by a local network attacker.

Root Cause

The root cause is missing validation of an input-derived pointer prior to dereference. Code paths reachable from local network traffic accept attacker-controlled data and pass it to a routine that assumes the pointer is valid. When the attacker provides input that results in a null reference, the operating system terminates the process or panics the kernel. Apple's fix introduces explicit input validation to ensure the pointer is non-null and the data conforms to expected structure.

Attack Vector

Exploitation requires the attacker to reside on the same local network as the target device. No credentials, privileges, or user interaction are needed. The attacker sends crafted network packets to a service exposed on the local network interface. The vulnerable handler processes the input, dereferences the null pointer, and crashes. The result is loss of availability for the affected service or device until restart.

No public proof-of-concept code is available for this issue. Refer to the Apple Support Article #127110, Apple Support Article #127115, and Apple Support Article #127118 for vendor-provided technical context.

Detection Methods for CVE-2026-28985

Indicators of Compromise

Unexpected process termination, kernel panics, or device reboots on iOS, iPadOS, macOS Tahoe, or tvOS systems running versions prior to 26.5.
Crash reports referencing null pointer access (EXC_BAD_ACCESS with address 0x0) following local network traffic.
Repeated service restarts correlated with traffic from a single host on the local subnet.

Detection Strategies

Monitor endpoint crash logs and ReportCrash artifacts for recurring faults that align with network activity.
Inspect local network traffic for malformed or anomalous packets directed at Apple device services.
Correlate device availability incidents with the presence of unmanaged or untrusted hosts on the same broadcast domain.

Monitoring Recommendations

Forward macOS unified logs and iOS device crash diagnostics to a centralized log platform for correlation.
Track operating system build versions across the fleet to confirm patch deployment to 26.5 or later.
Alert on repeated denial-of-service patterns affecting Apple endpoints on segments with shared Wi-Fi or guest access.

How to Mitigate CVE-2026-28985

Immediate Actions Required

Update affected devices to iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, or tvOS 26.5.
Inventory devices that cannot be immediately patched and restrict their network exposure.
Limit untrusted device access to corporate Wi-Fi segments hosting Apple endpoints.

Patch Information

Apple released fixes in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and tvOS 26.5. The patch adds input validation that prevents the null pointer dereference. See Apple Support Article #127110, Apple Support Article #127115, and Apple Support Article #127118 for the affected components and download instructions.

Workarounds

Segment Apple devices onto trusted VLANs or SSIDs that exclude untrusted hosts.
Enable client isolation on wireless networks to prevent peer-to-peer traffic between local clients.
Disable unnecessary local network services on devices that cannot be patched.

bash

# Verify macOS build version after patching
sw_vers -productVersion
# Expected: 26.5 or later