What is the CVSS score of CVE-2026-28917?

CVE-2026-28917 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-28917?

Yes, a patch is available for CVE-2026-28917. Update the affected software to the latest version immediately.

Apple iOS/iPadOS CVE-2026-28917

EUVD-2026-29238 MEDIUM

Improper Input Validation (CWE-20)

2026-05-11 apple

GHSA-88j2-27wc-pfg2

Denial Of Service Apple Tvos Visionos Watchos Ios And Ipados

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Web content delivery is network-based with no privilege requirement, but UI:R is mandatory; impact is solely a process crash with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:38 vuln.today

CVSS changed

May 12, 2026 - 19:22 NVD

4.3 (MEDIUM)

Patch available

May 11, 2026 - 22:03 EUVD

CVE Published

May 11, 2026 - 20:08 nvd

MEDIUM 4.3

CVE Published

May 11, 2026 - 20:08 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

AnalysisAI

Process crash vulnerability in Apple's web content processing stack affects iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS across both the legacy 18.x and new 26.x release trains. An unauthenticated remote attacker (per CVSS PR:N) can trigger an unexpected rendering process crash by delivering maliciously crafted web content to a user who visits or interacts with attacker-controlled material. The impact is limited to availability (denial of service via process crash) with no confidentiality or integrity consequences; no public exploit code exists and CISA has not listed this in KEV, consistent with the 0.03% EPSS score.

Technical ContextAI

The root cause is CWE-20 (Improper Input Validation) in the component responsible for processing web content - almost certainly Apple's WebKit browser engine, which underpins Safari and all third-party browsers on Apple platforms per Apple's platform policy. Insufficient validation of attacker-supplied input during web content parsing allows a malformed payload to reach a code path that results in an unexpected process termination. The fix, per Apple's advisory language, was 'improved input validation.' Affected CPEs span cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos, indicating the vulnerable parsing component is shared across Apple's operating system family.

RemediationAI

The primary remediation is to apply Apple's vendor-released patches: update iOS and iPadOS to 18.7.9 (legacy train) or 26.5 (new train), macOS Tahoe to 26.5, tvOS to 26.5, visionOS to 26.5, and watchOS to 26.5 via the standard Software Update mechanism. Advisory references are available at https://support.apple.com/en-us/127110 through https://support.apple.com/en-us/127121. For environments where immediate patching is operationally constrained, a targeted workaround is to restrict access to untrusted web content by disabling Safari's JavaScript execution via Screen Time or Mobile Device Management (MDM) content restriction profiles - note this degrades web functionality significantly. Alternatively, restricting devices to managed, allow-listed URLs via MDM web content filtering prevents delivery of crafted payloads while preserving core browsing capability for approved sites.