iOS CVE-2026-28894

Remote unauthenticated attacker can trigger DoS against unpatched iOS 26.3 and earlier, iPadOS 26.3 and earlier, macOS Sequoia 15.7.4 and earlier, macOS Sonoma 14.8.4 and earlier, or macOS Tahoe 26.3 and earlier via malformed input. No user interaction required.

Without a published CVSS score, EPSS probability, or KEV inclusion status, the real-world risk cannot be fully quantified using standard metrics. However, several signals indicate moderate to high priority: (1) Apple's issuance of patches across four distinct macOS versions (Sequoia, Sonoma, Tahoe) plus iOS/iPadOS within a single CVE suggests a widely applicable vulnerability; (2) the remote attack vector and lack of privilege requirements lower the barrier to exploitation; (3) denial-of-service vulnerabilities in core OS components can disrupt critical workflows and infrastructure. The absence of CVSS and EPSS data suggests either early-stage disclosure or potential embargoed information, but the breadth of affected products and the fact that patches are already available indicate this should be treated as a real priority for end-user systems and enterprise deployments.

A remote attacker crafts a malicious network packet or file that violates the expected input format for a kernel subsystem or core system service on an unpatched Apple device. When the vulnerable system processes this malformed input without adequate validation, it exhausts system memory, triggers an infinite loop, or crashes the affected process, rendering the device unresponsive and requiring a reboot to restore functionality. Since the attack is remotely triggerable without authentication, the attacker could target a large number of users or IoT-scale Apple devices in a coordinated denial-of-service campaign.