What is the CVSS score of CVE-2026-28886?

CVE-2026-28886 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28886?

Organizations using A null pointer dereference should be aware of moderate risk from CVE-2026-28886, a null pointer dereference vulnerability rated CVSS 5.9.. A patch is available.

How to fix or mitigate CVE-2026-28886?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28886

EUVD-2026-15165 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-03-25 apple

GHSA-3gqw-qcrw-37vv

Apple Null Pointer Dereference Denial Of Service macOS iOS

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,18.7.7,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15165

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.9

DescriptionCVE.org

A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A user in a privileged network position may be able to cause a denial-of-service.

AnalysisAI

Denial-of-service attacks against multiple Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS, and watchOS) result from improper null pointer handling that allows attackers in privileged network positions to crash affected systems. An attacker exploiting this CWE-476 vulnerability can render devices unavailable without user interaction. No patch is currently available, requiring users to apply mitigations until updates are released.

Technical ContextAI

This vulnerability is a null pointer dereference (CWE category: improper null pointer handling), which occurs when code attempts to access memory through a null pointer without proper validation. The affected products span Apple's entire ecosystem: iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados), macOS across multiple versions including Sequoia (15.7.5), Sonoma (14.8.5), and Tahoe (26.4) (cpe:2.3:a:apple:macos), tvOS (cpe:2.3:a:apple:tvos), visionOS (cpe:2.3:a:apple:visionos), and watchOS (cpe:2.3:a:apple:watchos). The root cause involves insufficient input validation before dereferencing a pointer, allowing a network-positioned attacker to trigger the null pointer condition and crash the affected component.

RemediationAI

Immediately upgrade affected Apple devices to patched versions: iOS and iPadOS to 18.7.7 or later (or 26.4 for newer versions), macOS Sequoia to 15.7.5, macOS Sonoma to 14.8.5, macOS Tahoe to 26.4, and tvOS, visionOS, and watchOS to 26.4 or later. Refer to the detailed security advisories at https://support.apple.com/en-us/126792 through https://support.apple.com/en-us/126799 for platform-specific instructions. For organizations unable to patch immediately, implement network segmentation to restrict untrusted network access to affected devices and monitor for unexpected service interruptions that may indicate exploitation attempts. Prioritize patching devices in critical network roles or those exposed to untrusted networks.