Skip to main content

WebKit CVE-2026-28904

| EUVDEUVD-2026-29229 HIGH
Buffer Overflow (CWE-119)
2026-05-11 apple GHSA-x38g-jvpg-6w2f
Buffer Overflow Apple Tvos Visionos Watchos Ios And Ipados
7.5
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Host malicious web content
  2. Delivery
    User browses to attacker site or opens HTML email
  3. Exploit
    WebKit parses crafted content
  4. Execution
    Trigger buffer overflow in memory handler
  5. Impact
    Read sensitive process memory or crash WebKit process

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

No special conditions - remote unauthenticated exploitation against default configurations of WebKit on iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network-accessible attack requiring no authentication, low complexity, and no user interaction beyond normal web content processing. Exploitation occurs automatically when the vulnerable WebKit engine processes the malicious content, which happens during routine web browsing, email HTML rendering, or any app feature using embedded web views. The phrase 'processing maliciously crafted web content' indicates the attack vector is content-based rather than protocol-based, meaning exploitation depends on specific content patterns triggering the buffer overflow rather than network configuration. However, exploitation may be limited by platform-specific memory layout, exploit reliability on different hardware architectures (ARM vs x86), and crash-inducing nature described in the advisory potentially preventing consistent exploitation for confidentiality impact.
Impact

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N indicates remote exploitation without authentication or user interaction, typically suggesting high risk. However, the impact vector C:H/I:N/A:N (high confidentiality impact only, no integrity or availability impact) combined with the description stating 'unexpected process crash' reveals an apparent inconsistency requiring clarification. CVSS indicates confidentiality breach but the description describes denial of service (process crash), which should be A:H not C:H. This scoring discrepancy suggests either incorrect CVSS assignment or incomplete vulnerability understanding. The EPSS score of 0.03% (10th percentile) indicates security researchers assess actual exploitation probability as very low despite theoretical network-based attack surface. No CISA KEV listing and no public POC suggest this remains theoretical. Real-world risk appears moderate: the widespread deployment across Apple's ecosystem creates large attack surface, but low exploitation probability and available patches reduce urgency compared to actively exploited vulnerabilities. Organizations should prioritize patching based on asset exposure to untrusted web content rather than CVSS score alone.
Exploit ScenarioDerived

An attacker hosts malicious web content containing specially crafted HTML, JavaScript, or media designed to trigger the buffer overflow in WebKit's rendering engine. A victim visits the malicious website using Safari or any app utilizing WKWebView on an unpatched Apple device. The crafted content triggers the memory handling flaw, potentially allowing the attacker to read sensitive process memory containing cookies, authentication tokens, or other confidential data from the WebKit process space, though the description's mention of process crash suggests exploitation may be unreliable or the CVSS confidentiality rating may be incorrect.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 12, 2026

Memory corruption in WebKit across Apple's ecosystem enables confidentiality breach via malicious web content without user interaction. Affects iOS/iPadOS versions prior to 18.7.9 and 26.5, macOS Tahoe prior to 26.5, and all Apple operating systems (tvOS, visionOS, watchOS) prior to 26.5. Despite CVSS 7.5 (High), the EPSS score of 0.03% (10th percentile) indicates minimal real-world exploitation likelihood at time of analysis. No active exploitation confirmed (not in CISA KEV), and no public exploit code identified. Apple has released patches across all affected platforms.

RemediationAI

Update to patched versions immediately: iOS and iPadOS 18.7.9 or 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Apple's security updates are available through standard system update mechanisms (Settings > General > Software Update on iOS/iPadOS, System Settings > General > Software Update on macOS). Full advisory details are available at https://support.apple.com/en-us/127110, https://support.apple.com/en-us/127111, https://support.apple.com/en-us/127115, https://support.apple.com/en-us/127118, https://support.apple.com/en-us/127119, and https://support.apple.com/en-us/127120. If immediate patching is not feasible, organizations can implement network-level content filtering to block access to untrusted websites, though this significantly impacts user functionality and does not protect against malicious content in trusted contexts like email HTML rendering or in-app web views. Safari's Lockdown Mode (available on iOS 16+, macOS Ventura+) provides additional hardening by disabling JIT compilation and other attack surfaces, but severely restricts web functionality and is only practical for high-risk users. No effective workaround exists that maintains normal web browsing capability.

Affected VersionsENISA

visionOS 0 <26.5
tvOS 0 <26.5
iOS and iPadOS 0 <26.5
iOS and iPadOS 0 <18.7.9
watchOS 0 <26.5
macOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 18.7.9, 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability stems from a buffer overflow (CWE-119) in WebKit, Apple's browser engine used across iOS, macOS, tvOS, visionOS, and watchOS. Buffer overflows occur when memory write operations exceed allocated buffer boundaries, potentially corrupting adjacent memory regions. The description indicates improved memory handling addressed the flaw, suggesting the original implementation lacked proper bounds checking during web content parsing or rendering. WebKit processes HTML, CSS, JavaScript, and media content, making it a critical attack surface for web-based exploits. The CPE strings identify this as affecting Apple's core operating system components rather than standalone applications, indicating the vulnerability exists in system-level WebKit frameworks shared across Safari and in-app web views.

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
CVSS changed
May 12, 2026 - 14:22 NVD
7.5 (HIGH)
Patch available
May 11, 2026 - 22:03 EUVD
CVE Published
May 11, 2026 - 20:07 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:07 nvd
HIGH 7.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Executive ViewAI

Why It Matters

A memory corruption vulnerability in Apple's WebKit engine affects all Apple operating systems and could allow attackers to view sensitive user data through malicious web content without requiring user interaction. While rated High severity, real-world exploitation risk is minimal based on EPSS scoring, but patching is recommended to eliminate the attack surface across the organization's Apple device fleet.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Medium
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28904 ADVISORY https://vuldb.com/vuln/362808 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28904 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483960 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28904.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127111 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy