CVE-2026-28992: Apple iPadOS Use-After-Free Vulnerability

CVE-2026-28992 Overview

CVE-2026-28992 is a memory corruption vulnerability affecting multiple Apple operating systems. The flaw stems from improper locking, classified under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization, also known as a race condition). A local attacker with low privileges can trigger the condition to cause unexpected application termination. Apple addressed the issue through improved locking primitives across its OS portfolio.

Critical Impact

A local attacker can trigger memory corruption via a race condition, resulting in unexpected app termination and a denial-of-service condition on affected Apple devices.

Affected Products

• Apple iOS 18.7.9 / iPadOS 18.7.9 and iOS 26.5 / iPadOS 26.5
• Apple macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5
• Apple tvOS 26.5, visionOS 26.5, and watchOS 26.5

Discovery Timeline

• 2026-05-11 - CVE-2026-28992 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28992

Vulnerability Analysis

The vulnerability is a race condition affecting shared resources within Apple operating systems. When two or more execution paths access the same memory region without proper synchronization, the resulting state can corrupt memory structures. Apple's advisory states the issue was addressed with improved locking, indicating the original code path lacked adequate mutual exclusion around a critical section.

Exploitation requires local access and elevated complexity, since the attacker must reliably win a race against legitimate operations. The outcome observed by Apple is unexpected app termination, which maps to an availability impact rather than confidentiality or integrity compromise.

Root Cause

The root cause is insufficient synchronization between concurrent threads or processes accessing shared state. Without correct locking, one execution context can read or modify data while another context mutates it, leaving objects in an inconsistent state. Subsequent dereferences against the corrupted structure produce a fault that terminates the affected application.

Attack Vector

The attack vector is local, requiring an attacker to execute code on the device with low privileges. The attacker repeatedly invokes the racing code path to provoke the unsynchronized window. No user interaction is required. Successful exploitation results in process crash rather than code execution, based on Apple's stated impact.

No verified proof-of-concept code is publicly available. Readers seeking technical detail should consult the linked Apple Support Advisory #127110 and the related advisories below.

Detection Methods for CVE-2026-28992

Indicators of Compromise

• Repeated unexpected termination of a specific application on an Apple endpoint, particularly when the same process crashes across reboots.
• Crash logs in ~/Library/Logs/DiagnosticReports/ (macOS) or device crash reports (iOS/iPadOS) referencing memory corruption or synchronization-related faults.
• Local processes spawning unusual numbers of threads or making high-frequency syscalls against the affected subsystem.

Detection Strategies

• Monitor endpoint telemetry for repeated ReportCrash events tied to the same binary on macOS hosts.
• Track OS build versions across the fleet and flag devices running pre-patch versions of iOS, iPadOS, macOS, tvOS, visionOS, or watchOS.
• Correlate local user sessions with abnormal process crash rates to identify potential exploitation attempts.

Monitoring Recommendations

• Centralize Apple device crash reports and alert on clustered crashes that share a common signature.
• Maintain an inventory of Apple OS versions and prioritize devices not yet on the patched builds.
• Review local privilege boundaries on shared macOS workstations where untrusted users may run code.

How to Mitigate CVE-2026-28992

Immediate Actions Required

• Update affected Apple devices to iOS 18.7.9 / iPadOS 18.7.9, iOS 26.5 / iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5.
• Enforce mobile device management (MDM) policies that require minimum patched OS versions before granting access to corporate resources.
• Restrict local code execution on shared macOS systems and audit accounts with interactive login rights.

Patch Information

Apple released fixes across its full OS portfolio. Reference the vendor advisories: Apple Support Advisory #127110, #127111, #127115, #127116, #127117, #127118, #127119, and #127120. Patching is the definitive remediation, as the fix corrects the underlying locking logic.

Workarounds

• No vendor-supplied workaround exists; apply the OS update as the primary remediation.
• Limit local user access on multi-user macOS systems until patching is complete.
• Disable or restrict third-party applications that exercise the affected subsystem if a specific trigger is identified in vendor follow-up guidance.

# Verify the macOS build on an endpoint and confirm it meets the patched version
sw_vers -productVersion

# Trigger software update check on macOS
sudo softwareupdate -l
sudo softwareupdate -ia --restart