Apple Operating Systems CVE-2026-28897

Exploitation requires direct local access to the affected device or the ability to execute code as an unprivileged local user on the system. The vulnerability does NOT require user interaction, special user privileges, or any particular device configuration-it affects default installations. The vulnerability is remotely triggerable ONLY if an attacker first gains local code execution through a separate vulnerability or misconfiguration. The buffer overflow occurs in a system component that processes local input without sufficient bounds checking; the exact component and input source are not specified in the advisory, limiting precision of this assessment. Exploitation is strictly LOCAL (AV:L per CVSS vector), meaning remote attackers cannot directly trigger this vulnerability across a network.

Risk assessment reveals significant disconnect between CVSS scoring and real-world exploitation probability. CVSS 6.2 with AV:L/AC:L/PR:N/UI:N indicates a moderately severe local vulnerability with low attack complexity and no prerequisites, supporting the score. However, EPSS percentile of 9% (0.03% probability) strongly suggests actual exploitation attempts are minimal or non-existent despite the advisory being publicly available. This disparity reflects the critical limiting factor: the attack vector is LOCAL ONLY, restricting exploitation to adversaries with direct system access. The vulnerability's impact (denial of service plus information disclosure) carries moderate severity, but requires the attacker to already possess local code execution capability or direct device access-a precondition significantly reducing real-world threat scope compared to remote vulnerabilities affecting the same products. SSVC analysis would rate this as: Exploitation=Unproven (no active exploitation reported), Automatable=Yes (stack buffer overflow is generally exploitable via automated tooling once local execution is achieved), Technical Impact=Moderate (kernel memory access and DoS). For most organizations, patching priority should be standard rather than emergency, unless the affected system is in a high-risk physical environment or handles untrusted local input from low-privileged users.

An attacker with local access to an unpatched Apple device crafts a specially designed input that triggers the buffer overflow in a kernel-accessible function. Upon processing this input, the stack buffer overflows, corrupting adjacent memory and either crashing the kernel (causing unexpected system termination) or allowing the attacker to read sensitive kernel memory locations. No user interaction is required; the exploit executes automatically when the vulnerable code path is triggered with the malformed input.