What is the CVSS score of CVE-2026-28874?

CVE-2026-28874 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of iOS are affected by CVE-2026-28874?

CVE-2026-28874 is a high-severity denial-of-service vulnerability affecting Apple iOS and iPadOS versions prior to 26.4 that enables unauthenticated attackers to remotely crash applications without…. A patch is available.

How to fix or mitigate CVE-2026-28874?

Within 24 hours: Inventory all iOS and iPadOS devices in your environment and document current OS versions; notify device owners of the vulnerability. Within 7 days: Deploy iOS/iPadOS 26.4 or later across all organizational devices through your MDM solution; confirm completion rates by device category. Within 30 days: Conduct post-patch validation of critical business applications on iOS/iPadOS to ensure functionality and complete patch remediation for any stragglers.

iOS CVE-2026-28874

EUVD-2026-15150 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-03-25 apple

GHSA-g93j-w95x-p4ww

Apple Denial Of Service iOS

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:16 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15150

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

HIGH 7.5

DescriptionCVE.org

The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote attacker may cause an unexpected app termination.

AnalysisAI

Unpatched denial-of-service vulnerability in Apple iOS and iPadOS allows unauthenticated remote attackers to crash applications due to insufficient input validation. The vulnerability requires no user interaction and affects all versions prior to 26.4, with no security patch currently available.

Technical ContextAI

This vulnerability resides in the iOS and iPadOS operating systems (CPE: cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), indicating a system-level or bundled application component with insufficient input validation or bounds checking. The lack of assigned CWE information prevents precise root-cause classification, but the pattern of 'improved checks' in the fix suggests a classic input validation weakness, potentially related to buffer overflows (CWE-120), improper input validation (CWE-20), or null pointer dereferences (CWE-476). The remote attack vector without requiring user interaction indicates the flaw may exist in a network protocol handler, background service, or auto-invoked system component.

RemediationAI

Users and organizations must upgrade to iOS 26.4 or iPadOS 26.4 or later to patch this vulnerability. The upgrade path is through Settings > General > Software Update on affected devices, or via iTunes/Finder for macOS-managed devices. Apple provides security updates for all supported device models; verify device compatibility with iOS 26.4 availability via https://support.apple.com/en-us/126792. No workarounds are available short of patching, as the flaw exists at the OS level. Organizations managing iOS devices via MDM should create a deployment policy to roll out iOS 26.4 or later within 30 days of release to maintain security compliance. If network-level filtering is required, contact Apple Support or your MDM vendor for additional guidance, though Apple does not typically disclose specific attack patterns for closed-source OS flaws.