What is the CVSS score of CVE-2026-28822?

CVE-2026-28822 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28822?

Organizations using A type confusion should be aware of moderate risk from CVE-2026-28822 rated CVSS 6.2. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-28822?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28822

EUVD-2026-15087 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-03-25 apple

Apple Memory Corruption Information Disclosure macOS iOS

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,14.8.5,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15087

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 6.2

DescriptionCVE.org

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An attacker may be able to cause unexpected app termination.

AnalysisAI

Type confusion in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows local attackers to trigger unexpected application termination through memory corruption. The vulnerability affects multiple OS versions and currently lacks a publicly available patch. An attacker with local access can exploit this to cause denial of service by crashing targeted applications.

Technical ContextAI

This vulnerability stems from a type confusion flaw in memory management within Apple's core operating system frameworks. Type confusion occurs when code incorrectly interprets memory as a different data type than intended, leading to unsafe operations. The vulnerability affects the Apple ecosystem broadly as indicated by CPE coverage spanning iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados), macOS (cpe:2.3:a:apple:macos), tvOS (cpe:2.3:a:apple:tvos), visionOS (cpe:2.3:a:apple:visionos), and watchOS (cpe:2.3:a:apple:watchos). The root cause involves improper type handling in memory allocation and deallocation routines, classified under memory safety defects. The fix involves improved type validation and bounds checking in memory operations across these platforms.

RemediationAI

Upgrade to the patched versions immediately: iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4 or later. Consult the corresponding Apple support advisories (https://support.apple.com/en-us/126792 through 126799) for platform-specific upgrade procedures and timing. For organizations unable to patch immediately, implement application monitoring to detect and log unexpected terminations that may indicate exploitation attempts, and restrict untrusted application installations pending update deployment. Prioritize patching based on exposure: devices with continuous internet connectivity and multi-user access should be updated first.