Skip to main content

Tvos CVE-2026-28847

| EUVDEUVD-2026-29219 HIGH
Buffer Overflow (CWE-119)
2026-05-11 apple GHSA-hc7g-7gpm-6rm5
Buffer Overflow Apple Tvos Visionos Watchos Ios And Ipados
8.8
CVSS 3.1 · Vendor: apple
View

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Memory-corruption crash in Apple's WebKit web-content engine lets a malicious website terminate the content-rendering process across iOS/iPadOS, macOS, tvOS, visionOS and watchOS prior to the 26.5 (and 18.7.9) releases. The flaw is triggered simply by viewing attacker-controlled web content, requiring no authentication but one user action (opening a page). There is no public exploit identified at time of analysis and SSVC rates exploitation as none, though the assigned CVSS 8.8 reflects worst-case memory-corruption potential rather than the crash-only behavior Apple documents.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 04:20 cvss changed CVSS 8.8

Memory-corruption flaw in Apple's WebKit-based web content rendering engine allows a malicious web page to trigger an out-of-bounds memory access leading to an unexpected process crash across iOS, iPadOS, macOS Tahoe, tvOS, visionOS and watchOS. Exploitation requires the victim to open or render attacker-controlled web content, and Apple has shipped fixes in iOS/iPadOS 18.7.9 and the 26.5 OS family. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%), and CISA SSVC marks exploitation status as none.

v3 Jun 30, 2026 - 04:20 cvss changed CVSS 8.8

Memory-corruption denial of service in Apple's WebKit web-content engine allows a remote attacker to crash the content rendering process when a victim views maliciously crafted web content across iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed it through improved memory handling in iOS/iPadOS 18.7.9 and the 26.5 release train for all platforms. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC rates exploitation as none, so this is a vendor-rated 8.8 issue whose described real-world impact is process crash rather than confirmed code execution.

v2 Jun 30, 2026 - 04:18 cvss changed CVSS 8.8

Memory-corruption flaw in Apple's WebKit web-content engine lets a malicious web page crash the content process, and given the CWE-119 buffer-overflow root cause and the vendor-assigned C:H/I:H/A:H CVSS the impact may extend beyond denial of service toward potential code execution; it affects iOS/iPadOS, macOS Tahoe, tvOS, visionOS and watchOS. Exploitation requires the victim to load attacker-controlled content (UI:R) but no authentication. There is no public exploit identified at time of analysis, EPSS probability is very low (0.03%), and it is not on CISA KEV.

v1 Jun 08, 2026 - 10:51 CVSS 6.5

Process crash denial-of-service across Apple's entire device ecosystem - iOS, iPadOS, macOS, tvOS, visionOS, and watchOS - stems from improper memory handling during web content processing. An unauthenticated remote attacker can cause an unexpected process crash by inducing a victim to interact with maliciously crafted web content, exploiting a CWE-119 memory bounds violation. No public exploit has been identified at time of analysis, EPSS stands at 0.03%, and SSVC confirms no observed exploitation, placing this firmly in a lower priority tier despite its network-facing vector.

Affected VersionsENISA

iOS and iPadOS 0 <26.5
tvOS 0 <26.5
visionOS 0 <26.5
macOS 0 <26.5
watchOS 0 <26.5
iOS and iPadOS 0 <18.7.9

Affected Packages

euvd ios_and_ipados fix: 18.7.9, 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 4.3 MEDIUM

Remote web content with required user interaction (UI:R), but the only documented impact is a single web-process crash, so C:N/I:N and A:L rather than the input's full C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

10
Analysis Updated
Jun 30, 2026 - 04:21 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:20 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:20 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:18 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:24 NVD
MEDIUM HIGH
CVSS changed
Jun 30, 2026 - 03:24 NVD
6.5 (MEDIUM) 8.8 (HIGH)
CVSS changed
May 13, 2026 - 16:22 NVD
6.5 (MEDIUM)
Patch available
May 11, 2026 - 22:03 EUVD
CVE Published
May 11, 2026 - 20:07 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:07 nvd
MEDIUM 6.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Zero Day Initiative Advisories

ZDI-26-313 Apple Safari Regular Expression Duplicate Named Groups Heap-based Buffer Overflow Remote Code Execution Vulnerability May 2026

Executive ViewAI

Why It Matters

A memory-corruption vulnerability in Apple's WebKit engine (CVE-2026-28847) allows attackers to crash the web-rendering process on any user viewing a malicious website, affecting iPhones, iPads, Macs, Apple TVs, Vision Pro devices, and smartwatches. No user authentication is required-only opening a web page. Vendor-released patches are available and should be prioritized across the Apple ecosystem.

Recommended Action

Within 24 hours: Issue guidance to users and communicate patch availability. Notify endpoint management teams to prepare deployment. Within 7 days: Validate patches in test environment (iOS/iPadOS 26.5, macOS 26.5, tvOS 26.5, visionOS 26.5, watchOS 18.7.9 or later) and initiate phased rollout. Within 30 days: Complete deployment across all Apple-managed devices; monitor for patch compliance.

Business Impact: High
Compensating Controls

Apply vendor patch. Until patched, educate users to avoid untrusted websites and consider restricting web access on critical-use devices; no interim technical mitigation exists for this memory-corruption flaw.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28847 ADVISORY https://vuldb.com/vuln/362783 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28847 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483955 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28847.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127111 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121 REF https://www.zerodayinitiative.com/advisories/ZDI-26-313/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy