iOS CVE-2026-28874

No special conditions — remote unauthenticated exploitation against default installations of iOS 26.4 and iPadOS 26.4. Attacker can trigger denial of service causing unexpected app termination without user interaction or authentication.

While CVSS and EPSS scores are unavailable, the risk profile presents mixed signals. The attack vector is remote and requires no user interaction, which elevates practical exploitability. However, the impact is limited to denial-of-service (application crash) rather than data disclosure or privilege escalation—a significant constraint on business impact. The absence of CVSS/EPSS scoring and KEV listing suggests this is either a recently disclosed or low-priority vulnerability in Apple's triage. The 'Information Disclosure' tag in the vulnerability metadata appears inconsistent with the description (which only mentions app termination), indicating possible metadata pollution or incomplete disclosure. Real-world risk is moderate: attackers can disrupt user productivity and service availability, but cannot exfiltrate data or gain system access. Organizations should patch on the normal iOS/iPadOS release cycle rather than treating this as emergency critical.

A remote attacker crafts a malicious network packet or specially formatted data payload and sends it to a vulnerable iOS/iPadOS device over the internet, targeting a network service or auto-invoked background handler. Upon receipt, the application processes the input without proper validation, triggering a crash or memory fault that causes the app or system service to terminate unexpectedly. The user perceives this as a spontaneous app crash with no visible cause, potentially disrupting their work or triggering multiple restart cycles if the attack is repeated—though no known public exploit code or proof-of-concept has been disclosed at this time.