macOS CVE-2026-28842

Remote unauthenticated attacker can trigger buffer overflow in macOS Tahoe versions prior to 26.4. No user interaction required. Affects default installations. Results in denial of service through unexpected application termination.

The real-world risk assessment is constrained by missing quantitative data: no CVSS vector, no EPSS score, and no confirmed KEV or POC status are available. However, several qualitative factors elevate concern. First, buffer overflows are a classic and well-understood vulnerability class with established exploitation techniques spanning decades; the barrier to exploitation is generally moderate, not high. Second, Apple's explicit mention of potential memory corruption and unexpected app termination suggests the vulnerability can cause denial of service at minimum and potential code execution at worst. Third, the broad CPE (all macOS versions) indicates widespread exposure across Apple's user base. Without CVSS or EPSS, this cannot be quantitatively compared to other vulnerabilities, but the technical nature (memory safety issue in a privileged OS component) and the vendor's response (immediate patch release) suggest this warrants priority patching despite the absence of exploitation signals (KEV, public POC). Organizations should treat this as a moderate-to-high priority based on technical merit rather than exploit availability metrics.

An attacker with local or limited remote access (depending on the affected code path) sends a specially crafted input to a vulnerable macOS component, triggering a buffer overflow that writes beyond the allocated buffer boundary. This causes memory corruption, leading to application crash (denial of service) or, if the attacker crafts the payload carefully, potential arbitrary code execution with the privileges of the affected application or the system. For example, if the vulnerability is in a privileged system service or kernel component, exploitation could allow privilege escalation or system compromise; if in a user-space application, impact is limited to that application's privilege level.