iOS CVE-2026-28858

No special conditions — remote unauthenticated exploitation against default installations of iOS and iPadOS versions before 26.4. Affects all devices running vulnerable versions without requiring user interaction or authentication.

The risk assessment reveals a vulnerability with significant real-world impact despite missing quantitative metrics. The attack vector is remote with no authentication required, indicating broad exploitability potential. The technical impact—kernel memory corruption and denial of service—represents high severity from a confidentiality, integrity, and availability perspective. However, the absence of CVSS scoring, EPSS probability data, and KEV enumeration status complicates precise risk quantification. The availability of a vendor patch (iOS 26.4 and iPadOS 26.4) suggests Apple treated this as a priority fix. The kernel-level nature of the vulnerability suggests it could potentially be leveraged for privilege escalation or arbitrary code execution chains, elevating real-world priority. Organizations should prioritize this for patching based on the combination of remote exploitability, kernel impact, and patch availability rather than relying solely on unavailable CVSS metrics.

A remote attacker could craft a specially malformed network packet or malicious file that, when processed by the vulnerable iOS or iPadOS kernel subsystem, triggers the buffer overflow condition. The overflow corrupts adjacent kernel memory structures, either immediately crashing the device (denial of service) or potentially enabling further exploitation chains. Attack delivery could occur through network-based vectors (e.g., malicious server responses, crafted packets) or via local content delivery (e.g., opening a malicious document), with the remote attack vector suggesting network-based delivery is the primary threat path.