Skip to main content

WebKit CVE-2026-28905

| EUVDEUVD-2026-29230 HIGH
Buffer Overflow (CWE-119)
2026-05-11 apple GHSA-523x-p7vc-qqv3
Buffer Overflow Apple Tvos Visionos Ios And Ipados
7.5
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Victim browses to attacker-controlled website
  2. Delivery
    WebKit engine processes malicious content
  3. Exploit
    Trigger memory corruption in buffer handling
  4. Execution
    Access confidential data from process memory
  5. Impact
    Victim application crashes unexpectedly

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Remote exploitation against default configurations of WebKit in iOS, iPadOS, macOS, tvOS, and visionOS versions below 26.5. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special prerequisites: exploitation requires only that the victim's device process web content from an attacker-controlled source. No user interaction beyond normal web browsing is required (UI:N), no authentication is needed (PR:N), and attack complexity is low (AC:L). The vulnerability triggers during standard web content rendering operations, affecting both Safari browser usage and any third-party applications using WebKit web views. Exploitation is NOT limited by device configuration, feature toggles, or non-default settings. Attack surface includes direct website visits, malicious advertisements on legitimate sites, embedded content in emails or messages, and any application-integrated web content. The broad attack surface across five operating systems and automatic triggering make this exploitable in most real-world Apple device deployments that process web content from untrusted sources.
Impact

Significant discrepancy exists between the CVSS score (7.5 High) and multiple risk indicators suggesting lower practical threat. The CVSS vector shows unauthenticated remote exploitation with low complexity (AV:N/AC:L/PR:N/UI:N) and High Confidentiality impact, justifying the 7.5 score mathematically. However, the description states the outcome is merely 'unexpected process crash' (denial of service), which contradicts the C:H/I:N/A:N vector - process crashes should score as Availability impact, not Confidentiality. This inconsistency raises questions about whether the CVSS scoring accurately reflects the vulnerability's true impact. EPSS probability of 0.02% (5th percentile) indicates security researchers and attackers have shown minimal interest despite the theoretical severity. SSVC assessment confirms no active exploitation, automatable attack surface, and only partial technical impact. No KEV listing and no public POC identified. Real-world risk appears moderate: while the attack surface is broad (any device rendering web content), the limited EPSS score, lack of exploitation evidence, and available patches across all platforms reduce urgency. Priority should increase for internet-facing systems or environments where users browse untrusted websites, but is lower than other actively exploited WebKit vulnerabilities. The C:H impact rating requires verification - if accurate, this could enable cross-site information theft; if inaccurate, it's primarily a stability issue.
Exploit ScenarioDerived

An attacker hosts a malicious website containing specially crafted HTML, CSS, or JavaScript designed to trigger the memory handling flaw in WebKit. When a victim browses to this site using Safari or any application with embedded web views (email clients, social media apps, in-app browsers), the malicious content is processed by the vulnerable WebKit engine. The memory corruption condition is triggered automatically without requiring user interaction beyond loading the page. Given the CVSS Confidentiality:High impact, the attacker could potentially read sensitive memory contents such as authentication tokens, browsing history, or data from other tabs/applications, though the description's 'process crash' outcome suggests exploitation may be less reliable. No public proof-of-concept code identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 12, 2026

Memory corruption in WebKit across Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS) allows remote attackers to access sensitive information via malicious web content. CVSS vector indicates network-based exploitation requiring no user interaction or authentication (AV:N/AC:L/PR:N/UI:N), contradicting the description's 'process crash' outcome with the High Confidentiality impact rating. EPSS score of 0.02% (5th percentile) suggests low real-world exploitation probability. Vendor patches available for all affected platforms (version 26.5). SSVC framework rates this as automatable with partial technical impact but no observed exploitation.

RemediationAI

Update all affected Apple devices to version 26.5 or later: iOS 26.5 and iPadOS 26.5 for mobile devices, macOS Tahoe 26.5 for desktop systems, tvOS 26.5 for Apple TV devices, and visionOS 26.5 for Vision Pro headsets. Vendor-confirmed patches are available through standard Apple Software Update mechanisms as documented in Apple security advisories HT127110, HT127115, HT127118, and HT127120. For organizations unable to immediately deploy OS updates, implement network-layer web filtering to block access to known malicious domains and restrict web browsing to trusted sites only, though this provides incomplete protection since the vulnerability affects any web content processing including embedded web views in applications. Content Security Policy (CSP) headers and sandboxing of web content do not mitigate this memory corruption issue as it occurs within the rendering engine itself. No effective workaround exists beyond OS update given the fundamental nature of WebKit in the Apple ecosystem-disabling Safari leaves other applications using WebKit web views vulnerable.

Affected VersionsENISA

visionOS 0 <26.5
macOS 0 <26.5
tvOS 0 <26.5
iOS and iPadOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects WebKit, Apple's browser engine used across iOS, iPadOS, macOS, tvOS, and visionOS for rendering web content in Safari and in-app web views. Classified as CWE-119 (Improper Restriction of Operations within Memory Buffer Bounds), the flaw represents a buffer overflow or related memory safety issue in WebKit's content processing pipeline. The CPE strings identify all major Apple operating systems as affected, indicating the vulnerability exists in shared WebKit code rather than platform-specific implementations. Memory handling bugs in browser engines are critical attack surfaces because they process untrusted content from arbitrary websites. The CVSS vector's High Confidentiality impact combined with No Integrity/Availability impact suggests potential information disclosure rather than code execution, which conflicts with typical buffer overflow exploitation patterns that usually enable arbitrary code execution (CIA impact).

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
CVSS changed
May 12, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
May 11, 2026 - 22:03 EUVD
CVE Published
May 11, 2026 - 20:08 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:08 nvd
HIGH 7.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Executive ViewAI

Why It Matters

CVE-2026-28905 is a network-exploitable memory corruption vulnerability in WebKit affecting all Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS) that could allow remote attackers to access sensitive information through malicious web content without user interaction. While patches are available across all platforms, the vulnerability's network-based attack vector and lack of authentication requirements create exposure for any organization relying on Apple devices for business operations.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: implement network-level controls to restrict malicious web content access (web filtering, DNS blocking of known malicious domains), disable JavaScript on non-critical systems where feasible, enforce browser sandboxing policies, and monitor for suspicious user activity or unexpected process crashes on affected devices.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28905 ADVISORY https://vuldb.com/vuln/362809 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28905 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483961 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28905.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy