Apple iOS/macOS CVE-2026-28819

Exploitation requires a malicious application to be installed and run on the target device - the attacker cannot exploit this remotely without first achieving code execution in user space via a separate vector. The victim's device must be running an unpatched version of iOS/iPadOS (prior to 18.7.9) or macOS Sonoma (prior to 14.8.7), macOS Sequoia (prior to 15.7.7), or macOS Tahoe (prior to 26.5). Limiting factors include: Apple's App Store review process restricts trivial malicious app distribution on iOS; macOS Gatekeeper and notarization requirements impose additional barriers; and SSVC Automatable: none confirms exploitation cannot be scripted at scale. No network-facing exploitation path is described in the vendor advisories.

CRITICAL INCONSISTENCY in the provided CVSS data warrants explicit flagging: the supplied vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N is internally contradictory with the description. AV:N (Network) conflicts with 'an app may be able to execute arbitrary code with kernel privileges,' which describes a local app-based attack. Furthermore, S:U (Unchanged scope) conflicts with privilege escalation to kernel level, which constitutes a scope change (S:C), and C:L/I:L/A:N dramatically understates the impact of kernel code execution. The 5.4 Medium score appears significantly understated for this class of vulnerability. Independently assessed, this should score much higher. Against these issues: EPSS at 0.02% (5th percentile) and SSVC Exploitation: none align with no observed active exploitation, and Automatable: no reflects the need for a malicious app to be installed. KEV status is not listed. Real-world priority remains HIGH for consumer device fleets despite the misleading official CVSS, given the kernel-level impact if successfully exploited.

An attacker distributes a malicious iOS or macOS application - via a phishing campaign, compromised developer certificate, or sideloading - that triggers the out-of-bounds write in a kernel subsystem when executed. The app overwrites adjacent kernel memory structures to redirect execution flow, achieving ring-0 code execution and bypassing all user-space security controls. No public exploit code has been identified at time of analysis, and SSVC assesses this as not automatable, meaning mass exploitation is unlikely without a targeted delivery mechanism.