Skip to main content

Tvos CVE-2026-28859

| EUVDEUVD-2026-15133 MEDIUM
Out-of-bounds Read (CWE-125)
2026-03-25 apple
Buffer Overflow Information Disclosure Apple Tvos Visionos Watchos Ios And Ipados
4.3
CVSS 3.1 · Vendor: apple
View

Vulnerability Assessment

Weakness
CWE
CWE-125
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

While the CVSS score and vector are not numerically specified in available data, the vulnerability's nature as a sandbox escape carries critical real-world risk. The attack vector is network-based (requires visiting a malicious website), and complexity appears low given that no special privileges are required. The Information Disclosure tag suggests the technical impact involves unauthorized access to restricted content. The lack of EPSS score and KEV status designation in the provided intelligence suggests this may be a recently disclosed or pre-patch vulnerability. However, sandbox escape vulnerabilities are historically high-priority issues due to their ability to compromise the entire security model of a browser. The breadth of affected products (six major Apple operating systems) and the fact that Apple released coordinated patches across its entire ecosystem underscore the severity assessment. For SSVC analysis: this appears to be actively remediated (patches available), the memory handling nature suggests potential automatable exploitation in specific conditions, and the technical impact is high (unauthorized access to protected resources). Organizations should treat this as a critical priority despite missing numerical CVSS data.
Exploit ScenarioDerived

An attacker registers a malicious domain and lures a user to visit it via social engineering, phishing, or malvertising. Upon visiting the site, the attacker's JavaScript exploits the memory handling vulnerability to break out of the WebKit sandbox, gaining direct access to restricted content that should be isolated. This could allow the attacker to read sensitive files, steal credentials, or install persistent malware without additional user interaction beyond visiting the webpage. The low attack complexity and network attack vector make this a practical threat in real-world scenarios.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

A sandbox escape vulnerability in Apple's WebKit browser engine allows malicious websites to process restricted web content outside the security sandbox, potentially enabling unauthorized access to protected system resources. The vulnerability affects Safari and all Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple has addressed this issue through improved memory handling in Safari 26.4 and corresponding OS updates across all affected platforms.

RemediationAI

Immediately update to Safari 26.4 and the corresponding OS version 26.4 for your device (iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, or watchOS 26.4). Consult Apple's official security advisories at https://support.apple.com/en-us/126792 (and related URLs 126794, 126797, 126798, 126799, 126800) for OS-specific update instructions. Until patches can be deployed, minimize exposure to untrusted websites and consider restricting web browsing to pre-approved, trusted domains. Enable additional security features such as Content Security Policy (CSP) headers on internal websites and consider using network-level filtering to block known malicious domains.

Affected VersionsENISA

watchOS 0 <26.4
Safari 0 <26.4
macOS 0 <26.4
iOS and iPadOS 0 <26.4
visionOS 0 <26.4
tvOS 0 <26.4

Affected Packages

euvd ios_and_ipados fix: 26.4
euvd macos fix: 26.4
euvd safari fix: 26.4
euvd tvos fix: 26.4
euvd visionos fix: 26.4
euvd watchos fix: 26.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 6 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability resides in WebKit's memory management subsystem, which handles the rendering and execution of web content within sandboxed processes. The sandbox is a fundamental security boundary in modern browsers designed to isolate untrusted web content from system resources and other applications. The vulnerability appears to be rooted in improper memory handling (as indicated by the fix description), which could fall under memory corruption issues (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer or similar memory safety weaknesses). The affected CPE strings indicate the vulnerability impacts Apple's entire ecosystem: Safari (cpe:2.3:a:apple:safari), iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados), macOS (cpe:2.3:a:apple:macos), tvOS (cpe:2.3:a:apple:tvos), visionOS (cpe:2.3:a:apple:visionos), and watchOS (cpe:2.3:a:apple:watchos), all versions prior to the 26.4 releases.

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
SUSE MEDIUM
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Apr 16, 2026 - 05:29 EUVD
26.4
CVE Published
Mar 25, 2026 - 00:32 nvd
MEDIUM 4.3

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A malicious website may be able to process restricted web content outside the sandbox.

Executive ViewAI

Why It Matters

Organizations using The should be aware of moderate risk from CVE-2026-28859, a out-of-bounds read vulnerability rated CVSS 4.3. Exploitation could cause memory corruption or application crashes. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Low
Technical Impact
Partial

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in macOS Tahoe 26.4 Security Updates

View all 67
CVE-2026-28839 MEDIUM
5.3
CVE-2026-28879 MEDIUM
6.5
CVE-2026-20695 MEDIUM
6.2
CVE-2026-28825 HIGH
7.1
CVE-2026-28844 MEDIUM
6.5
CVE-2026-20665 MEDIUM
6.5
CVE-2026-20668 MEDIUM
5.5
CVE-2026-28835 MEDIUM
6.5
CVE-2026-28841 MEDIUM
6.2
CVE-2026-28864 LOW
3.3
CVE-2026-20694 MEDIUM
5.5
CVE-2026-20607 MEDIUM
4.0
CVE-2026-20632 MEDIUM
5.3
CVE-2026-20637 MEDIUM
6.2
CVE-2026-20651 MEDIUM
6.2
CVE-2026-20686 MEDIUM
5.3
CVE-2026-20687 HIGH
7.1
CVE-2026-20688 CRITICAL
9.3
CVE-2026-20691 MEDIUM
4.3
CVE-2026-20692 MEDIUM
5.3
CVE-2026-20693 MEDIUM
4.9
CVE-2026-20698 HIGH
7.8
CVE-2026-20699 MEDIUM
6.2
CVE-2026-20701 HIGH
7.5
CVE-2026-28816 MEDIUM
4.0
CVE-2026-28818 MEDIUM
5.3
CVE-2026-28820 MEDIUM
5.3
CVE-2026-28821 HIGH
8.4
CVE-2026-28822 MEDIUM
6.2
CVE-2026-28823 MEDIUM
4.9
CVE-2026-28827 CRITICAL
9.3
CVE-2026-28828 MEDIUM
5.3
CVE-2026-28829 MEDIUM
5.5
CVE-2026-28831 MEDIUM
5.5
CVE-2026-28832 HIGH
8.4
CVE-2026-28837 HIGH
7.5
CVE-2026-28842 HIGH
7.5
CVE-2026-28852 MEDIUM
5.5
CVE-2026-28862 MEDIUM
5.3
CVE-2026-28865 HIGH
7.5
CVE-2026-28866 MEDIUM
6.2
CVE-2026-28868 MEDIUM
5.5
CVE-2026-28886 MEDIUM
5.9
CVE-2026-28892 MEDIUM
5.5
CVE-2026-28893 LOW
3.3
CVE-2026-28894 HIGH
7.5
CVE-2025-43534 MEDIUM
6.8
CVE-2026-20690 MEDIUM
6.5
CVE-2026-28824 MEDIUM
5.3
CVE-2026-28833 MEDIUM
6.2
CVE-2026-28834 MEDIUM
5.1
CVE-2026-20633 MEDIUM
5.5
CVE-2026-20631 HIGH
8.8
CVE-2026-28817 HIGH
8.1
CVE-2026-20639 HIGH
7.5
CVE-2026-20664 MEDIUM
4.3
CVE-2026-28861 MEDIUM
4.3
CVE-2026-20684 LOW
3.3
CVE-2026-28838 MEDIUM
5.3
CVE-2026-20657 MEDIUM
6.5
CVE-2026-28826 MEDIUM
4.0
CVE-2026-28877 MEDIUM
5.5
CVE-2026-28878 MEDIUM
6.5
CVE-2026-28882 MEDIUM
4.0
CVE-2026-20622 HIGH
7.5

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/352956 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1364/ REF https://access.redhat.com/errata/RHSA-2026:10702 REF https://access.redhat.com/errata/RHSA-2026:11329 REF https://access.redhat.com/errata/RHSA-2026:11814 REF https://access.redhat.com/errata/RHSA-2026:13845 REF https://access.redhat.com/errata/RHSA-2026:14659 REF https://access.redhat.com/errata/RHSA-2026:16056 REF https://access.redhat.com/errata/RHSA-2026:16695 REF https://access.redhat.com/errata/RHSA-2026:19206 REF https://access.redhat.com/errata/RHSA-2026:19535 REF https://access.redhat.com/errata/RHSA-2026:22136 REF https://access.redhat.com/errata/RHSA-2026:9692 REF https://access.redhat.com/security/cve/CVE-2026-28859 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453006 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28859.json REF https://support.apple.com/en-us/126792 REF https://support.apple.com/en-us/126794 REF https://support.apple.com/en-us/126797 REF https://support.apple.com/en-us/126798 REF https://support.apple.com/en-us/126799 REF https://support.apple.com/en-us/126800

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy