CVE-2026-28990: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-28990 Overview

CVE-2026-28990 is a memory corruption vulnerability in Apple's image processing components affecting multiple operating systems. Processing a maliciously crafted image can corrupt process memory, potentially leading to information disclosure. The flaw is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Apple addressed the issue with improved memory handling across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS updates. The vulnerability is network-reachable with no user interaction or privileges required, and affects confidentiality. EPSS data places exploitation probability at 0.049% (15.366 percentile) as of 2026-05-17.

Critical Impact
A remote attacker can deliver a crafted image to a target device and corrupt process memory, exposing sensitive in-memory data without any user interaction.

Affected Products

Apple iOS and iPadOS (fixed in 26.5)
Apple macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5
Apple tvOS 26.5, visionOS 26.5, and watchOS 26.5

Discovery Timeline

2026-05-11 - CVE-2026-28990 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-28990

Vulnerability Analysis

The vulnerability resides in Apple's image processing code paths shared across its operating systems. When the affected component parses a maliciously crafted image, memory handling errors lead to corruption of process memory. Apple's advisory states the issue was addressed with improved memory handling, indicating the original implementation failed to enforce safe boundary or lifetime constraints on memory operations.

The weakness is categorized as [CWE-119], covering improper restriction of operations within memory buffer bounds. Such conditions commonly arise from missing bounds checks during parsing of attacker-controlled image fields such as dimensions, color profiles, or chunk headers. The flaw impacts confidentiality but not integrity or availability, suggesting the corruption path enables reading of out-of-bounds memory rather than arbitrary write or crash conditions.

Root Cause

The root cause is improper validation of input image data within Apple's image decoding routines. Parsing logic operates on attacker-supplied size or offset fields without sufficient checks, allowing the decoder to reference memory outside the intended buffer. Apple's fix introduces improved memory handling to constrain these operations.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker delivers a crafted image through any channel that triggers automatic image processing, such as messaging applications, web content, email previews, or shared documents. Once the vulnerable component processes the image, memory corruption occurs in the handling process. Public proof-of-concept exploit code is not available, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog.

The vulnerability mechanism is described in Apple's security advisories. See Apple's published guidance for component-level technical details: Apple Support Document #127110.

Detection Methods for CVE-2026-28990

Indicators of Compromise

Unexpected crashes or termination of image-handling processes such as ImageIO, MediaLibraryService, or Preview shortly after receiving image content.
Crash logs referencing memory faults in image decoding frameworks across affected Apple operating systems.
Inbound delivery of unusually structured image files (malformed headers, non-standard chunk sizes) through messaging, email, or browser channels.

Detection Strategies

Monitor endpoint telemetry on macOS systems for anomalous behavior in image-rendering processes, including crashes correlated with newly received attachments.
Inspect message and mail server logs for attachments matching known malicious image hashes or unusual MIME structures.
Hunt for post-exploitation activity such as unexpected network connections originating from processes that normally handle image rendering.

Monitoring Recommendations

Enable verbose crash reporting on managed Apple endpoints and forward reports to a centralized analysis pipeline.
Track operating system version inventory to identify devices still running pre-patch builds of iOS, iPadOS, macOS, tvOS, visionOS, or watchOS.
Alert on processes spawning from image-handling contexts that perform reconnaissance or external communication.

How to Mitigate CVE-2026-28990

Immediate Actions Required

Update all Apple devices to iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5.
Prioritize patching of devices that routinely process images from untrusted sources, including those used for email, messaging, and web browsing.
Audit mobile device management (MDM) compliance to confirm enforcement of the minimum patched OS version.

Patch Information

Apple released fixes in iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Refer to the corresponding vendor advisories: Apple Support Document #127110, Apple Support Document #127115, Apple Support Document #127116, Apple Support Document #127117, Apple Support Document #127118, Apple Support Document #127119, and Apple Support Document #127120.

Workarounds

Disable automatic image previews in messaging and email clients where configuration permits, reducing the chance of automatic decoding of untrusted content.
Restrict inbound attachments at the email gateway by inspecting and filtering image files originating from external senders.
Educate users to avoid opening unsolicited images from unknown contacts until devices are patched.

bash

# Verify macOS build version meets the patched release
sw_vers -productVersion

# Trigger Apple software update check on macOS
sudo softwareupdate -l
sudo softwareupdate -i -a -R