What is the CVSS score of CVE-2026-28835?

CVE-2026-28835 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28835?

Organizations using A use-after-free should be aware of notable risk from CVE-2026-28835, a use-after-free vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-28835?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28835

EUVD-2026-15107 MEDIUM

Use After Free (CWE-416)

2026-03-25 apple

GHSA-7x5f-fmvg-2g7r

Apple Use After Free Memory Corruption Information Disclosure macOS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,15.7.5,14.8.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15107

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 6.5

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Mounting a maliciously crafted SMB network share may lead to system termination.

AnalysisAI

macOS systems running Sequoia 15.7.4 or earlier, Sonoma 14.8.4 or earlier, and Tahoe 26.3 or earlier contain a use-after-free vulnerability in SMB share handling that could allow an attacker to crash the operating system by mounting a specially crafted network share. The vulnerability requires user interaction to mount the malicious share and results in denial of service rather than code execution or data compromise. No patch is currently available for this vulnerability.

Technical ContextAI

The vulnerability resides in macOS kernel or system SMB client implementation responsible for mounting and managing network file shares via the SMB/CIFS protocol. Use-after-free vulnerabilities occur when a program continues to reference memory that has been freed, potentially allowing memory corruption or control flow hijacking. In this case, the defect exists in how macOS handles the mounting process or lifecycle management of SMB share connections when processing maliciously crafted SMB protocol packets or share metadata. The affected product is Apple macOS across multiple versions (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), indicating the vulnerability is endemic to the core operating system's network file handling subsystem rather than an isolated application.

RemediationAI

Immediately upgrade to the patched versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later, depending on your installed version. Consult Apple's security advisories at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for detailed upgrade instructions. As interim mitigation, restrict mounting of SMB shares to trusted, verified network sources only; disable SMB auto-mounting if enabled; and require approval workflows before users mount network shares in enterprise environments. Organizations dependent on SMB file sharing should prioritize patching schedules for this vulnerability due to the ease of triggering the denial-of-service condition.