What is the CVSS score of CVE-2026-28852?

CVE-2026-28852 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-28852?

Organizations using A stack overflow should be aware of moderate risk from CVE-2026-28852, a input validation vulnerability rated CVSS 5.5.. A patch is available.

How to fix or mitigate CVE-2026-28852?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS CVE-2026-28852

EUVD-2026-15123 MEDIUM

Improper Input Validation (CWE-20)

2026-03-25 apple

Buffer Overflow Apple iOS macOS

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,18.7.7,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15123

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.5

DescriptionCVE.org

A stack overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to cause a denial-of-service.

AnalysisAI

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are vulnerable to a stack overflow vulnerability that can be triggered by user interaction with a malicious app, potentially causing denial-of-service conditions. The vulnerability stems from insufficient input validation and affects multiple recent OS versions across Apple's product ecosystem. While no patch is currently available, users should exercise caution when installing apps from untrusted sources.

Technical ContextAI

This vulnerability involves a stack overflow condition, which occurs when a program writes more data to a stack buffer than its allocated size, causing the stack to overflow and potentially overwrite adjacent memory. The root cause is classified under CWE (Common Weakness Enumeration) for buffer overflow or improper input validation. The affected products span Apple's entire platform ecosystem as indicated by the CPE strings: iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados), macOS (cpe:2.3:a:apple:macos), tvOS (cpe:2.3:a:apple:tvos), visionOS (cpe:2.3:a:apple:visionos), and watchOS (cpe:2.3:a:apple:watchos). The vulnerability requires malicious application code to trigger the stack overflow through crafted input, suggesting the weakness exists in a shared system library or framework used across these platforms rather than in individual apps.

RemediationAI

Immediate remediation requires upgrading to the patched versions: iOS and iPadOS 18.7.7 or later (or 26.4 and later for the newer branch), macOS Sequoia 15.7.5 or later (or macOS Tahoe 26.4 and later), tvOS 26.4 or later, visionOS 26.4 or later, and watchOS 26.4 or later. Users should enable automatic security updates in their device settings to receive these patches promptly. Until patches can be applied, administrators and users should restrict installation of applications from untrusted sources and avoid sideloading unsigned or unverified applications. For enterprise deployments, Mobile Device Management (MDM) solutions should be configured to enforce minimum OS versions and prevent installation of applications from unauthorized sources. Refer to the detailed remediation steps in Apple's support articles linked in the affected products section for platform-specific patching procedures.