iOS/iPadOS CVE-2026-28872

Exploitation requires network reachability to the vulnerable iOS/iPadOS input-handling service and delivery of malformed/crafted input that the pre-patch validation fails to bound (CWE-400). Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication and no user interaction are needed, so on default configurations a remote unauthenticated attacker with a network path to the device can trigger the condition. Limiting factors: the attacker must have network access to the specific vulnerable service/protocol (not merely Internet presence), the impact is availability-only (no data compromise), SSVC rates the technical impact as partial (likely degradation rather than guaranteed full outage), and any device already on iOS/iPadOS 18.7.9 or 26.4+ is not exploitable.

Signals are mixed and point to a real-but-moderate availability risk rather than a critical priority. The CVSS 3.1 base score of 7.5 derives entirely from AV:N/AC:L/PR:N/UI:N with A:H and no C/I impact - i.e., easy remote triggering but availability-only harm. Countervailing signals lower the urgency: EPSS is only 0.05% (17th percentile), SSVC records Exploitation: none and Technical Impact: partial, and the issue is not on CISA KEV. The one aggravating factor is SSVC Automatable: yes, meaning the trigger can likely be scripted/repeated, which matters for opportunistic DoS. Net: this is a genuine remote DoS worth patching in normal cycles, but it is not evidence of active or imminent mass exploitation. Note a mild tension worth flagging - CVSS scope is Unchanged and impact is A:H (total availability loss), whereas SSVC calls technical impact only 'partial'; the practical outcome may be service degradation or a resource-exhaustion condition rather than a persistent full outage. Verify real-world impact severity with Apple if precise blast radius is needed.

A remote attacker on a network path to the device sends specially crafted input to the vulnerable iOS/iPadOS input handler, causing uncontrolled resource consumption that degrades or disrupts device functionality without any user interaction or authentication. Because the trigger is automatable (SSVC), the attacker can script and repeat it against reachable devices. No public exploit code has been identified at time of analysis.