What is the CVSS score of CVE-2026-28872?

CVE-2026-28872 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of iOS/iPadOS are affected by CVE-2026-28872?

Apple iOS and iPadOS devices in your organization are vulnerable to remote denial-of-service attacks that could temporarily degrade device functionality.. A patch is available.

How to fix or mitigate CVE-2026-28872?

Within 24 hours, identify iOS/iPadOS devices in your organization running versions prior to iOS 18.7.9 or iPadOS 26.4 using your MDM or asset inventory system. Within 7 days, deploy patch guidance to device owners and configure automated update policies to enforce iOS 18.7.9 or iPadOS 26.4 as minimum versions. Within 30 days, verify patch adoption across managed devices and document any holdouts requiring manual remediation or exception justification.

iOS/iPadOS CVE-2026-28872

EUVD-2026-29222 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-11 apple

GHSA-c5vh-f4mr-vcqw

Denial Of Service Apple Ios And Ipados

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, no auth or interaction to trigger (AV:N/AC:L/PR:N/UI:N); availability-only resource-exhaustion impact with no confidentiality or integrity effect (C:N/I:N/A:H), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:37 vuln.today

CVSS changed

May 12, 2026 - 19:22 NVD

7.5 (HIGH)

Patch available

May 11, 2026 - 22:03 EUVD

CVE Published

May 11, 2026 - 20:08 nvd

HIGH 7.5

CVE Published

May 11, 2026 - 20:08 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.

AnalysisAI

Denial-of-service in Apple iOS and iPadOS lets a remote attacker exhaust device resources through maliciously crafted input, degrading availability without compromising data confidentiality or integrity. All iOS/iPadOS builds before 18.7.9 and before 26.4 are affected, and Apple has shipped fixes in both trains. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.05%, 17th percentile) despite the network-facing CVSS 7.5 rating.

Technical ContextAI

The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), meaning some parser, service, or protocol handler in iOS/iPadOS fails to properly bound the resources consumed when processing attacker-supplied input; Apple's advisory states it was 'addressed with improved input validation,' indicating malformed or oversized input previously drove excessive CPU, memory, or other resource usage. The affected component is Apple's mobile operating system stack (CPE cpe:2.3:a:apple:ios_and_ipados), which underpins iPhone and iPad devices. Because the CVSS vector is AV:N with no privileges or user interaction, the vulnerable code path is reachable over the network - consistent with a service or protocol-level input handler rather than a locally-triggered bug. Apple's terse disclosure practice means the exact subsystem (e.g., networking daemon, media/messaging parser) is not named in the available data.

RemediationAI

Vendor-released patch: iOS 18.7.9 / iPadOS 18.7.9 (legacy train) and iOS 26.4 / iPadOS 26.4 (current train) - update affected iPhones and iPads to the appropriate fixed build for their major version. Apply via Settings > General > Software Update or MDM; consult Apple's advisories at https://support.apple.com/en-us/126792 and https://support.apple.com/en-us/127111 for the build mapping. No vendor workaround is documented for this specific issue, which is expected for an OS-internal input-validation fix; because the vector is network-reachable, interim compensating controls until patching include keeping devices off untrusted networks and restricting exposure of the affected service where network policy allows - with the trade-off that a mobile OS DoS component often cannot be selectively disabled, so timely OS update is the only reliable remediation.