What is the CVSS score of CVE-2026-28875?

CVE-2026-28875 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-28875?

CVE-2026-28875 is a high-severity denial-of-service vulnerability affecting iOS and iPadOS 26.4 and earlier that allows remote attackers to crash devices over the network without authentication.. A patch is available.

How to fix or mitigate CVE-2026-28875?

Within 24 hours: Inventory all iOS and iPadOS devices running version 26.4 or earlier across the organization and assess business-critical dependencies. Within 7 days: Implement network segmentation to restrict unnecessary inbound access to affected mobile devices; consider disabling unnecessary network services where feasible. Within 30 days: Upgrade all affected iOS and iPadOS devices to version 26.5 or later once the vendor-released patch is available and validated in your environment.

iOS CVE-2026-28875

EUVD-2026-15151 HIGH

Classic Buffer Overflow (CWE-120)

2026-03-25 apple

Apple Buffer Overflow iOS

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:16 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15151

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

HIGH 7.5

DescriptionCVE.org

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.

AnalysisAI

iOS and iPadOS devices are vulnerable to denial-of-service attacks due to insufficient buffer bounds checking that allows remote attackers to crash affected systems without authentication. The vulnerability affects iOS 26.4 and earlier versions, requiring network access but no user interaction. No patch is currently available for this HIGH severity issue.

Technical ContextAI

This buffer overflow vulnerability (CWE class involving improper bounds checking) exists in the iOS and iPadOS operating system core, as indicated by the broad CPE cpe:2.3:a:apple:ios_and_ipados. Buffer overflows occur when a program writes data beyond the allocated memory boundaries of a buffer, potentially corrupting adjacent memory. Apple's remediation specifically references improved bounds checking, indicating the root cause was insufficient validation of input size before writing to fixed-size buffers. The vulnerability is exploitable remotely, suggesting it may exist in network-facing code paths such as network protocol handlers, media processing libraries, or remote service handlers that process untrusted input without proper length validation.

RemediationAI

Immediately update to iOS 26.4 or iPadOS 26.4 or later, which contain the improved bounds checking that addresses this buffer overflow. Users should navigate to Settings > General > Software Update and install the latest available version. For organizations managing iOS/iPadOS devices at scale, enable automatic security updates where possible and prioritize deployment of version 26.4 across mobile device inventory. Until patching is complete, consider enforcing network segmentation to limit exposure of vulnerable devices to untrusted networks, though this is a secondary mitigation to patching. Apple's security advisory at https://support.apple.com/en-us/126792 contains complete patching instructions.