Visionos CVE-2026-28857

|

EUVD

EUVD-2026-15129 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-25 apple

GHSA-xc63-96v5-38fr

Buffer Overflow Information Disclosure Apple Visionos Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

View

Vulnerability Assessment

Weakness	CWE CWE-125 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	Risk assessment is constrained by the absence of a CVSS score and EPSS probability data, making quantitative comparison impossible. However, qualitative signals suggest moderate to elevated real-world risk: (1) The attack vector is network-based and requires minimal user interaction (visiting a malicious webpage), implying broad exposure; (2) Denial of service via process crash is a lower-severity impact than remote code execution, but still disruptive; (3) No KEV (Known Exploited Vulnerability) designation or public proof-of-concept has been mentioned, suggesting the vulnerability was not actively exploited in the wild before patching; (4) Apple's rapid patch deployment across four major product lines (Safari, iOS, iPadOS, macOS, visionOS) indicates internal recognition of the issue's significance. The lack of a published CVSS vector prevents assessment of attack complexity and privilege requirements, but memory corruption bugs in browser engines are traditionally considered high-complexity exploits requiring specific heap layout conditions. For enterprise risk prioritization, this should be classified as medium-priority: patch promptly to prevent DoS incidents, but lower urgency than unpatched RCE vulnerabilities.
Exploit ScenarioDerived	An attacker hosts a malicious webpage containing specially crafted HTML, CSS, or embedded media designed to trigger a memory handling flaw in WebKit's rendering engine. When a victim visits this webpage using Safari or any of the affected Apple devices and operating systems, the malicious content causes the browser process to read or write outside allocated memory bounds, resulting in an immediate process crash and denial of service. The attacker could distribute the malicious link via email, social media, or malicious advertisements to target a broad victim base without requiring user-level code execution or admin privileges, making this a low-barrier attack vector for disruption campaigns or as a component of a multi-stage exploit chain.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 25, 2026

This vulnerability affects Apple's Safari browser and related Apple operating systems (iOS, iPadOS, macOS Tahoe, and visionOS) due to improper memory handling when processing maliciously crafted web content. The flaw can lead to unexpected process crashes, resulting in a denial of service condition affecting all users of the impacted Safari versions and OS versions below 26.4. While no CVSS score or EPSS data is currently published, the vulnerability has been patched by Apple, suggesting it was discovered through internal security review or responsible disclosure rather than active exploitation.

RemediationAI

Immediately upgrade to Safari 26.4 on macOS, iOS 26.4 on iPhone/iPad devices, macOS Tahoe 26.4 on Mac computers, and visionOS 26.4 on Apple Vision Pro devices. For enterprise environments, configure Mobile Device Management (MDM) or System Preferences to enforce automatic security updates, ensuring all Apple devices receive patches within 24-48 hours of availability. For users unable to patch immediately, mitigate risk by disabling JavaScript or restricting web browsing to trusted, internal websites, or by using network controls to block access to known malicious domains via DNS filtering or web proxies. Monitor Apple's security advisory pages (https://support.apple.com/en-us/126792, https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126799, https://support.apple.com/en-us/126800) for additional guidance or follow-up patches addressing related issues.

Affected VersionsENISA

visionOS 0 <26.4

iOS and iPadOS 0 <26.4

Safari 0 <26.4

macOS 0 <26.4

Affected Packages

euvd ios_and_ipados fix: 26.4

euvd macos fix: 26.4

euvd safari fix: 26.4

euvd visionos fix: 26.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The vulnerability resides in the memory management subsystem of Apple's WebKit rendering engine, which powers Safari across all affected Apple platforms (identified via CPE strings: cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, and cpe:2.3:a:apple:visionos). The root cause falls under improper memory handling, a class of defect typically encompassing use-after-free, buffer overflow, or heap corruption conditions triggered during the parsing and rendering of web content. The attack surface is the web content rendering pipeline, which processes HTML, CSS, JavaScript, and media from untrusted sources. No specific CWE identifier has been disclosed, but memory safety issues in browser engines commonly map to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) or CWE-416 (Use After Free). The fix involved refactoring memory allocation, deallocation, or bounds checking within the affected code path.

Know when Visionos gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SUSE MEDIUM

Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

2

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

CVE Published

Mar 25, 2026 - 00:31 nvd

MEDIUM 6.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.

Executive ViewAI

Why It Matters

Organizations using The should be aware of notable risk from CVE-2026-28857, a out-of-bounds read vulnerability rated CVSS 6.5. Exploitation could cause memory corruption or application crashes. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Moderate

Compensating Controls

Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation

None

System Exposure· derived

Open

Automatable

No

Technical Impact

Partial

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Apple iOS and iPadOS 26.4 Security Issues

View all 10

CVE-2026-28863 MEDIUM

CVE-2026-28856 MEDIUM

CVE-2026-28871 MEDIUM

CVE-2026-28874 HIGH

CVE-2026-28875 HIGH

CVE-2026-28895 MEDIUM

CVE-2026-28880 MEDIUM

CVE-2026-28876 HIGH

CVE-2026-28858 CRITICAL

More in Visionos

View all

CVE-2025-31277 HIGH Act Now POC

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici

CVE-2025-43510 HIGH Act Now POC

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee

CVE-2025-24201 CRITICAL Act Now

A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con

CVE-2025-43520 MEDIUM This Month POC

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t

CVE-2024-44308 HIGH Act Now

Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra

CVE-2025-14174 HIGH Act Now

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-6558 HIGH Act Now

Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa

CVE-2025-43529 HIGH Act Now

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2

CVE-2024-44309 MEDIUM This Month

A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi

CVE-2025-43200 MEDIUM Act Now

A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).

CVE-2025-43359 CRITICAL Act Now POC

A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re

CVE-2024-27815 HIGH Act Now

An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

CVE-2016-5198 HIGH POC

CVE-2025-5777 CRITICAL POC

CVE-2016-1646 HIGH POC

CVE-2017-5030 HIGH POC

CVE-2016-4523 HIGH

CVE-2024-48456 HIGH POC

CVE-2024-48457 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7	Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28857 ADVISORY https://vuldb.com/vuln/352959 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1364/ REF https://access.redhat.com/errata/RHSA-2026:10702 REF https://access.redhat.com/errata/RHSA-2026:11329 REF https://access.redhat.com/errata/RHSA-2026:11814 REF https://access.redhat.com/errata/RHSA-2026:13845 REF https://access.redhat.com/errata/RHSA-2026:14659 REF https://access.redhat.com/errata/RHSA-2026:16056 REF https://access.redhat.com/errata/RHSA-2026:16695 REF https://access.redhat.com/errata/RHSA-2026:19206 REF https://access.redhat.com/errata/RHSA-2026:19535 REF https://access.redhat.com/errata/RHSA-2026:22136 REF https://access.redhat.com/errata/RHSA-2026:9692 REF https://access.redhat.com/security/cve/CVE-2026-28857 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453004 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28857.json REF https://support.apple.com/en-us/126792 REF https://support.apple.com/en-us/126794 REF https://support.apple.com/en-us/126799 REF https://support.apple.com/en-us/126800

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy