What is the CVSS score of CVE-2026-28858?

CVE-2026-28858 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-28858?

Organizations using A buffer overflow face critical risk from CVE-2026-28858, a buffer overflow vulnerability rated CVSS 9.8.. A patch is available.

How to fix or mitigate CVE-2026-28858?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. If patching is delayed, consider network segmentation to limit exposure.

iOS CVE-2026-28858

EUVD-2026-15131 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-03-25 apple

Apple Buffer Overflow iOS

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15131

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

CRITICAL 9.8

DescriptionCVE.org

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

AnalysisAI

Insufficient bounds checking in Apple iOS and iPadOS 26.4 allows unauthenticated remote attackers to trigger buffer overflow conditions that corrupt kernel memory or cause system crashes without user interaction. This critical vulnerability affects all devices running the affected OS versions and has no available patch. An attacker can exploit this flaw over the network to achieve denial of service or potentially escalate privileges through kernel memory corruption.

Technical ContextAI

The vulnerability stems from inadequate bounds checking in memory buffer operations within the iOS and iPadOS kernel or system libraries. Buffer overflow vulnerabilities (CWE-120 class) occur when a program writes data beyond the allocated memory boundary of a buffer, potentially overwriting adjacent memory structures. In this case, the affected technology is the core Apple iOS and iPadOS operating system (CPE: cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), which handles low-level memory management for mobile devices. The vulnerability was remediated by implementing stricter input validation and bounds checking mechanisms to prevent out-of-bounds writes that could corrupt kernel memory structures critical to system stability and security.

RemediationAI

Immediately upgrade iOS and iPadOS devices to version 26.4 or later through the Settings application under System > Software Update, ensuring devices are connected to power and Wi-Fi during the update process. Enforcement of automatic updates through Mobile Device Management (MDM) solutions is recommended for organizations managing iOS/iPadOS fleets. While patches are available from Apple, interim risk mitigation prior to patching involves restricting network exposure of affected devices where feasible and monitoring for abnormal system crashes that may indicate exploitation attempts. Refer to Apple's official security advisory at https://support.apple.com/en-us/126792 for device-specific guidance and any known deployment issues.