What is the CVSS score of CVE-2026-28879?

CVE-2026-28879 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-28879?

Organizations using A use-after-free should be aware of notable risk from CVE-2026-28879, a use-after-free vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-28879?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS CVE-2026-28879

EUVD-2026-15160 MEDIUM

Use After Free (CWE-416)

2026-03-25 apple

Denial Of Service Use After Free Memory Corruption Apple iOS macOS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,14.8.5,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15160

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 6.5

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.

AnalysisAI

Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS contain a use-after-free vulnerability that could allow remote attackers to crash affected applications by processing maliciously crafted web content. The vulnerability stems from improper memory management and requires user interaction to exploit. No patch is currently available, leaving users vulnerable until official updates are released.

Technical ContextAI

This vulnerability is a use-after-free memory safety issue within WebKit, Apple's rendering engine responsible for processing web content across all affected platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS). Use-after-free vulnerabilities (related to CWE-416) occur when code attempts to access memory that has already been freed, resulting in undefined behavior. The affected products span multiple CPU architectures and operating systems: iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), macOS variants including Sequoia, Sonoma, and Tahoe (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), tvOS (cpe:2.3:a:apple:tvos:*:*:*:*:*:*:*:*), visionOS (cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*), and watchOS (cpe:2.3:a:apple:watchos:*:*:*:*:*:*:*:*). The vulnerability is triggered during the processing of web content, suggesting the attack vector is network-based and requires no authentication.

RemediationAI

Immediately update to the patched versions: iOS/iPadOS 18.7.7 or 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. Consult Apple's security bulletins at https://support.apple.com/en-us/126792 through https://support.apple.com/en-us/126799 for platform-specific patch instructions. As a temporary mitigation, restrict web browsing to trusted sites only and disable JavaScript if the user can tolerate reduced functionality, though neither measure fully eliminates risk. For enterprise deployments, enforce Mobile Device Management (MDM) policies to mandate updates and consider deploying content filtering to restrict access to potentially malicious web sources until all endpoints are patched.