What is the CVSS score of CVE-2026-28842?

CVE-2026-28842 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28842?

CVE-2026-28842 is a high-severity remote denial-of-service vulnerability affecting Apple macOS Tahoe versions prior to 26.4 that allows unauthenticated attackers to crash affected systems through…. A patch is available.

How to fix or mitigate CVE-2026-28842?

Within 24 hours: Inventory all macOS Tahoe systems and identify those running versions prior to 26.4. Within 7 days: Apply vendor-released patch to upgrade all affected macOS Tahoe systems to version 26.4 or later. Within 30 days: Verify patch deployment across 100% of inventory through endpoint management tools and document remediation completion.

macOS CVE-2026-28842

EUVD-2026-15117 HIGH

Classic Buffer Overflow (CWE-120)

2026-03-25 apple

GHSA-xvfm-vcfx-8599

Apple Buffer Overflow macOS

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:16 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15117

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

HIGH 7.5

DescriptionCVE.org

The issue was addressed with improved bounds checks. This issue is fixed in macOS Tahoe 26.4. A buffer overflow may result in memory corruption and unexpected app termination.

AnalysisAI

A buffer overflow vulnerability in Apple macOS Tahoe prior to version 26.4 enables remote attackers to trigger a denial-of-service condition through memory corruption and application crashes without requiring user interaction or authentication. The flaw stems from insufficient bounds checking and currently lacks a security patch. This vulnerability affects all macOS users running vulnerable versions.

Technical ContextAI

This buffer overflow vulnerability (CWE category for out-of-bounds memory access) exists in the macOS Tahoe operating system and was introduced through improper bounds checking in a specific code component. Buffer overflows occur when a program writes data beyond the allocated boundary of a buffer in memory, potentially corrupting adjacent memory regions, heap metadata, or stack return addresses. Apple's fix explicitly addresses this through improved bounds checks, indicating that input validation or length verification was insufficient prior to writing to a fixed-size or dynamically allocated buffer. The vulnerability is system-level and affects the macOS core or bundled applications, as indicated by the CPE specification cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, covering all macOS versions without version-specific constraints prior to patching.

RemediationAI

Immediately upgrade to macOS Tahoe version 26.4 or later, which includes the improved bounds checks that resolve this vulnerability. Visit https://support.apple.com/en-us/126794 for detailed patch instructions and verification steps. If immediate patching is not feasible, restrict local and network access to affected macOS systems to trusted users and network segments only, disable unnecessary network services, and monitor system logs for signs of memory corruption or unexpected application crashes that could indicate exploitation attempts. Prioritize patching within 48 to 72 hours given the memory safety nature of the vulnerability.