Skip to main content

Apple WebKit CVE-2026-28901

| EUVDEUVD-2026-29226 MEDIUM
Buffer Overflow (CWE-119)
2026-05-11 apple GHSA-6cxc-cp8p-4h26
Buffer Overflow Apple Tvos Visionos Watchos Ios And Ipados
4.3
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious web content
  2. Delivery
    Deliver link to target via phishing
  3. Exploit
    Victim opens URL in WebKit browser
  4. Execution
    Memory corruption triggered in renderer
  5. Impact
    Renderer process crashes unexpectedly

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The victim must actively process attacker-controlled web content - by visiting a malicious URL in Safari or any WKWebView-embedded browser on an unpatched Apple device, or via a WebKitGTK-based application on unpatched RHEL. The CVSS UI:R requirement is the primary limiting factor: passive network exposure is insufficient; the user must take an action (click a link, open a message, navigate to a page). No authentication, no privileged configuration, and no non-default settings are required on the attacker side. Exploitation is bounded by the rendering process sandbox on modern Apple platforms, limiting the direct impact to a process crash rather than full system compromise.
Impact

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) correctly reflects a network-reachable, unauthenticated crash limited to the rendering process scope, with no confidentiality or integrity impact. The UI:R constraint is meaningful: a victim must actively visit or open attacker-controlled web content, ruling out automated mass exploitation. SSVC confirms Automatable:no and Technical Impact:partial, consistent with the CVSS reading. EPSS at 0.02% (5th percentile) signals that the security community assigns very low probability of near-term exploitation. There is no CISA KEV entry and no public POC identified. Taken together, these signals converge: this is a genuine stability/DoS issue with broad platform coverage but low operational risk priority for most defenders. The primary real-world risk is targeted browser-crash scenarios or exploitation as part of a longer exploit chain if the bounds violation can be upgraded to a memory-corruption primitive - but no such capability is confirmed in available data.
Exploit ScenarioDerived

An attacker crafts a malicious web page containing content specifically structured to trigger the out-of-bounds memory operation, then lures a target user into visiting it via a phishing link, email, or social-media post. When the victim's device processes the page content in a WebKit context, the renderer process crashes, resulting in application or tab termination. No public exploit code or POC has been identified, and no active exploitation has been confirmed.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Improper memory handling in Apple's web content processing engine triggers an unexpected process crash when a user visits or renders maliciously crafted web content, affecting every current Apple platform. The vulnerability is confirmed patched in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5, and the presence of multiple Red Hat errata references suggests the underlying component (likely WebKitGTK) also carries impact into Linux distributions. No public exploit code and no active exploitation have been identified; EPSS sits at the 5th percentile and CISA SSVC rates exploitation as none.

RemediationAI

The primary fix is to upgrade to the patched Apple OS releases: iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5, available via Settings > General > Software Update on each respective platform. Advisory details are at https://support.apple.com/en-us/127110 (iOS/iPadOS), https://support.apple.com/en-us/127115 (macOS), and the remaining Apple support pages in the references. For RHEL environments, apply the WebKitGTK updates documented in the Red Hat errata listed above via 'dnf update webkit2gtk4.1' or the applicable package name. Where immediate patching is not possible, restricting use of WebKit-based browsers or disabling automatic link-following in managed environments reduces exposure, though this carries significant usability trade-offs. There is no vendor-documented workaround that fully mitigates the crash without patching.

Affected VersionsENISA

watchOS 0 <26.5
tvOS 0 <26.5
macOS 0 <26.5
visionOS 0 <26.5
iOS and iPadOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates the root cause is an out-of-bounds memory operation - a class that encompasses buffer overflows, overreads, and adjacent-memory corruption. The description's fix wording ('improved memory handling') is consistent with a bounds check or allocation guard added to the web content parser or renderer. The triggering vector - processing web content - strongly implies the WebKit engine, which is the shared rendering component embedded in Safari, WKWebView-based apps, and WebKitGTK on Linux. The CPE data confirms affected OS platforms as cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos, all with versions prior to 26.5. Red Hat errata references (RHSA-2026:25918, 25927, 27728, 27785, 27804, 28114, 28146) indicate the same underlying memory bug reaches WebKitGTK packages on RHEL, broadening the scope beyond Apple-native deployments.

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
vuln.today AI 4.3 MEDIUM

Network-delivered web content requires active user interaction (UI:R); impact limited to process crash with no confidentiality or integrity effect, so C:N/I:N/A:L.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

4
CVSS changed
May 12, 2026 - 21:22 NVD
4.3 (MEDIUM)
Patch available
May 11, 2026 - 22:03 EUVD
CVE Published
May 11, 2026 - 20:08 nvd
MEDIUM 4.3
CVE Published
May 11, 2026 - 20:08 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Prevalence
High
iOS and macOS deployed across hundreds of millions of consumer and enterprise devices
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28901 ADVISORY https://vuldb.com/vuln/362805 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28901 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483957 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28901.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy