What is the CVSS score of CVE-2026-28841?

CVE-2026-28841 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28841?

Organizations using A buffer overflow should be aware of moderate risk from CVE-2026-28841, a buffer overflow vulnerability rated CVSS 6.2.. A patch is available.

How to fix or mitigate CVE-2026-28841?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28841

EUVD-2026-15115 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-03-25 apple

Apple Buffer Overflow macOS

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15115

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

MEDIUM 6.2

DescriptionCVE.org

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Tahoe 26.4. A buffer overflow may result in memory corruption and unexpected app termination.

AnalysisAI

macOS Tahoe versions prior to 26.4 contain a buffer overflow vulnerability that can cause denial of service through unexpected application termination or memory corruption when exploited by local attackers. The vulnerability stems from insufficient size validation in memory operations and requires no user interaction to trigger. No patch is currently available for affected systems.

Technical ContextAI

This vulnerability represents a classic buffer overflow condition, categorized under improper input validation and buffer management. The affected product is Apple macOS (CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), indicating the vulnerability affects multiple macOS versions prior to the Tahoe 26.4 release. The root cause involves insufficient size validation before writing to a fixed-size buffer, allowing an attacker to write beyond allocated memory boundaries. Buffer overflows in system software can corrupt heap or stack memory structures, potentially leading to code execution if an attacker can control the overflow data. The fix implemented in macOS Tahoe 26.4 addresses this through improved input size validation mechanisms.

RemediationAI

Immediately upgrade to macOS Tahoe 26.4 or later, which contains the improved size validation fix addressing this buffer overflow. Users should navigate to System Settings > General > Software Update to apply the patch. Until systems can be patched, restrict untrusted application execution, disable unnecessary network services, and monitor system logs for abnormal application crashes or memory errors that may indicate exploitation attempts. For enterprise environments, prioritize patching critical systems and consider implementing application whitelisting to limit attack surface. Refer to Apple's security advisory at https://support.apple.com/en-us/126794 for vendor-specific guidance and additional mitigations.