Skip to main content

Apple WebKit CVE-2026-28902

| EUVDEUVD-2026-29227 MEDIUM
Buffer Overflow (CWE-119)
2026-05-11 apple GHSA-9rrc-92m2-c228
Buffer Overflow Apple Tvos Visionos Watchos Ios And Ipados
6.5
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker hosts malicious web page
  2. Delivery
    Victim clicks link or is redirected
  3. Exploit
    WebKit parses crafted content
  4. Execution
    Out-of-bounds memory operation triggered (CWE-119)
  5. Persist
    Rendering process crashes
  6. Impact
    App or browser session unavailable (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

User interaction is required: the victim must actively process attacker-controlled web content (CVSS UI:R), such as clicking a link, opening a message with embedded content, or being redirected to a malicious URL. No authentication or elevated privileges are needed on the attacker's side (PR:N). The vulnerability is triggered in the WebKit web content processing path and therefore applies to any application on the affected platforms that renders web content - not limited to Safari alone. Exploitation is limited by the need for user interaction (no drive-by without at least a redirect), by the DoS-only impact (no code execution path is described), and by the absence of any confirmed exploit code or automated delivery mechanism. Non-default configurations are not required; any device running an affected OS version with a WebKit-capable application is within the attack surface.
Impact

The CVSS base score of 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H characterizes this as a remotely triggerable, low-complexity denial-of-service that requires one click of user interaction (visiting a webpage) but no authentication. The high availability impact reflects a reliable process crash rather than a fleeting glitch. However, multiple converging signals argue against elevated triage priority: EPSS is extremely low at 0.02% (5th percentile), meaning the broader security community has not observed or anticipates minimal exploitation activity; SSVC independently corroborates this with 'Exploitation: none' and 'Technical Impact: partial'; and KEV status is absent, confirming no confirmed in-the-wild abuse at time of analysis. The DoS-only impact (no code execution, no data leakage) further limits attacker utility. For consumer-facing deployments where Safari or WebKit-embedded apps process untrusted content, this is a routine patch-cycle item; for environments with strict uptime requirements on WebKit-based kiosks or embedded browsers, slightly elevated urgency applies.
Exploit ScenarioDerived

An attacker hosts a malicious webpage containing specially crafted HTML, JavaScript, or media content designed to trigger an out-of-bounds memory operation in WebKit's content parser. A victim on an unpatched Apple device visits the page via Safari, an in-app WebView, or any application that renders web content - requiring a single click or redirect - causing the rendering process to crash. The result is a denial of service for the affected app or browser session; no public exploit code has been identified at time of analysis, and SSVC rates this as non-automatable, indicating mass exploitation at scale is not straightforward.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Web content processing across all major Apple platforms is vulnerable to a memory mismanagement flaw (CWE-119) that causes an unexpected process crash when a user visits or renders attacker-controlled web content. Affected platforms include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS - all versions prior to the 26.5 release line. The impact is limited to availability (A:H), with no confidentiality or integrity exposure per the CVSS vector, and no active exploitation is confirmed - EPSS sits at 0.02% (5th percentile) and SSVC rates exploitation as none, making this a moderate-priority patch rather than an emergency response item.

RemediationAI

The primary fix is to apply the vendor-released patches across all affected platforms: upgrade to iOS 26.5 and iPadOS 26.5 (https://support.apple.com/en-us/127110, https://support.apple.com/en-us/127115), macOS Tahoe 26.5 (https://support.apple.com/en-us/127118), tvOS 26.5 (https://support.apple.com/en-us/127119), visionOS 26.5 (https://support.apple.com/en-us/127120), and watchOS 26.5 (https://support.apple.com/en-us/127121). These are available through standard Apple Software Update channels and MDM deployment pipelines. Where immediate patching is not feasible, compensating controls include restricting access to untrusted web content by disabling Safari's ability to open arbitrary URLs from external sources, deploying a web content filter or DNS-based block list to prevent navigation to unknown domains, and disabling JavaScript execution in WebKit-based in-app browsers where business workflows permit - note that disabling JavaScript broadly will break most modern web applications and is generally only viable in kiosk or restricted-use deployments. No workaround fully substitutes for the patch since the crash surface exists anywhere WebKit processes content.

Affected VersionsENISA

iOS and iPadOS 0 <26.5
tvOS 0 <26.5
watchOS 0 <26.5
visionOS 0 <26.5
macOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in Apple's web content processing subsystem, almost certainly WebKit - the browser engine underpinning Safari and all in-app web views across Apple platforms. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) covers the root cause class: the engine performs a memory operation (read, write, or both) outside the intended buffer boundary when parsing or rendering maliciously crafted content. Apple's advisory language ('addressed with improved memory handling') is consistent with a bounds-check fix or guard-page insertion. The CPE strings confirm the affected surface spans cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos - all sharing the same WebKit codebase, which explains the simultaneous cross-platform patching. The tags referencing Red Hat and Suse likely reflect third-party tracker metadata (VulnDB/EUVD indexing distributors that monitor the CVE) rather than indicating those platforms are directly affected.

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
May 13, 2026 - 16:22 NVD
6.5 (MEDIUM)
Patch available
May 11, 2026 - 22:03 EUVD
CVE Published
May 11, 2026 - 20:07 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:07 nvd
MEDIUM 6.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28902 ADVISORY https://vuldb.com/vuln/362806 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28902 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483958 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28902.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy