CVE-2026-28991: Apple iPadOS DOS Vulnerability

CVE-2026-28991 Overview

CVE-2026-28991 is an out-of-bounds read vulnerability [CWE-125] affecting multiple Apple operating systems. A malicious application can trigger the flaw to cause a denial-of-service condition on the affected device. Apple addressed the issue with improved bounds checking across its operating system lineup.

The vulnerability impacts iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Apple fixed it in version 26.5 of each platform. The issue carries network-based exploitability characteristics, with availability as the primary affected security property.

Critical Impact
An application can leverage an out-of-bounds memory read to crash a system service or process, producing a denial-of-service on the affected Apple device.

Affected Products

Apple iOS and iPadOS prior to 26.5
Apple macOS Tahoe prior to 26.5
Apple tvOS, visionOS, and watchOS prior to 26.5

Discovery Timeline

2026-05-11 - CVE-2026-28991 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28991

Vulnerability Analysis

The vulnerability is an out-of-bounds read classified under [CWE-125]. An out-of-bounds read occurs when code reads data past the end, or before the beginning, of an allocated buffer. In this case, the affected Apple component fails to validate buffer boundaries before performing a memory read operation.

When an attacker-controlled application triggers the unsafe read path, the process accesses memory outside the intended allocation. This can return undefined data or cause the process to terminate, resulting in a denial-of-service condition on the device.

Apple's advisories describe the remediation as improved bounds checking, indicating that the patched code now validates index or length parameters before dereferencing the affected buffer.

Root Cause

The root cause is missing or insufficient bounds validation before a memory read operation in an Apple operating system component. The code path accepts input that influences a read offset or length without confirming that the resulting access stays inside the allocated buffer.

Attack Vector

Exploitation requires a malicious or compromised application running on the target device. The application invokes the vulnerable code path with crafted inputs that drive the read past buffer boundaries. The result is a denial-of-service. Confidentiality and integrity are not impacted according to the published CVSS vector.

No verified proof-of-concept code is publicly available for CVE-2026-28991. Refer to the Apple security advisories for technical details on affected components.

Detection Methods for CVE-2026-28991

Indicators of Compromise

Unexpected crashes or termination of system services on Apple devices running versions earlier than 26.5.
Crash reports in the device diagnostic logs referencing EXC_BAD_ACCESS or memory access violations originating from third-party applications.
Repeated application-initiated process restarts shortly after launching or interacting with an untrusted app.

Detection Strategies

Inventory managed Apple endpoints and flag any device that has not received the 26.5 update for iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS.
Review mobile device management (MDM) compliance reports for OS version drift across the fleet.
Monitor application crash telemetry in enterprise mobility tooling for patterns consistent with repeated out-of-bounds reads.

Monitoring Recommendations

Forward device crash logs and MDM compliance events into a centralized analytics platform for correlation.
Track application install events for unsigned or sideloaded applications on macOS endpoints.
Alert when devices running pre-26.5 builds connect to corporate networks or access sensitive resources.

How to Mitigate CVE-2026-28991

Immediate Actions Required

Update all affected Apple devices to iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.
Enforce minimum OS version requirements through MDM policies to block non-compliant devices from corporate resources.
Restrict installation of untrusted or sideloaded applications on managed endpoints.

Patch Information

Apple released fixes for CVE-2026-28991 in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Patch details and download instructions are available in the vendor advisories: Apple Support 127110, Apple Support 127115, Apple Support 127118, Apple Support 127119, and Apple Support 127120.

Workarounds

No vendor-provided workaround exists. Apply the 26.5 update for each affected platform as the primary remediation.
Limit installation of third-party applications from untrusted sources until devices are patched.
Use MDM conditional access controls to quarantine unpatched devices from sensitive enterprise resources.

bash

# Verify macOS version meets the patched build
sw_vers -productVersion

# Example MDM compliance check (pseudocode)
# Require: ProductVersion >= 26.5 for iOS, iPadOS, macOS, tvOS, visionOS, watchOS