What is the CVSS score of CVE-2026-28896?

CVE-2026-28896 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-28896?

Yes, a patch is available for CVE-2026-28896. Update the affected software to the latest version immediately.

macOS CVE-2026-28896

EUVD-2026-49541 HIGH

Buffer Overflow (CWE-119)

2026-07-27 apple

GHSA-f7hf-r92j-x7jv

Buffer Overflow Apple

7.7

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.7 HIGH

Local access, low complexity, no privileges required; high confidentiality impact (kernel memory read) and high availability impact (system crash).

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 18:33 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

7.7 (HIGH)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

HIGH 7.7

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An attacker may be able to cause unexpected system termination or read kernel memory.

AnalysisAI

Local kernel memory disclosure and denial-of-service vulnerability in macOS 14.x and 15.x prior to patches. An unauthenticated attacker with local access can trigger a memory handling flaw to read kernel memory or cause unexpected system termination. No active exploitation or public exploit code is known; EPSS score is very low (0.14%).

Technical ContextAI

The vulnerability involves improper memory handling (CWE-119) in the macOS kernel, leading to a buffer overflow condition. This allows an attacker with local code execution to leak sensitive kernel memory contents or destabilize the system, causing a crash. The CPE data indicates all macOS versions prior to the fixed releases are affected.

RemediationAI

Apply the vendor patches by upgrading to macOS Sonoma 14.8.8 or macOS Sequoia 15.7.8. No workarounds are provided. Limiting local access and employing the principle of least privilege can reduce risk until patching is completed.