iOS CVE-2026-28875

No special conditions — remote unauthenticated exploitation against default installations of iOS and iPadOS versions before 26.4. Attack vector requires network access but no user interaction or authentication.

The real-world risk is moderate to low despite the buffer overflow classification. While buffer overflows are traditionally high-severity, this CVE is explicitly limited to denial-of-service impact rather than remote code execution, significantly reducing its severity. The absence of a CVSS score and vector data prevents quantitative risk scoring, but the lack of publicized exploitation, absence of KEV status designation, and unavailability of public proof-of-concept code all indicate this is not an actively exploited vulnerability. The attack vector is remote with likely no authentication required (based on the remote attacker premise), which would normally elevate priority, but the constraint to DoS-only impact and the rapid patch availability (iOS 26.4) substantially mitigate real-world risk. Organizations should prioritize patching but this is not an emergency zero-day scenario.

An attacker could craft a malicious network packet or specially formatted input (such as a crafted media file, network protocol message, or web content) targeting a vulnerable iOS/iPadOS device. When the vulnerable code processes this input without proper bounds checking, the buffer overflow occurs, corrupting memory and causing the affected process or entire device to crash, resulting in denial-of-service. This attack requires network connectivity but not authentication or user interaction beyond receiving the malicious input, making it relatively accessible to a remote attacker.