Apple iOS/iPadOS CVE-2026-28918

Exploitation requires the victim to actively open or trigger parsing of a maliciously crafted file (UI:R per CVSS vector). No authentication or prior access to the target device is required from the attacker's perspective (PR:N). The attack must be delivered via a network-accessible channel (AV:N) - e.g., email, messaging app, web browser, or file-sharing service - for the file to reach the victim. The limiting factor is mandatory user interaction: the victim must choose to open the file. No special non-default configuration or privileged access is required on the target system; the vulnerability exists in the default file parsing code. The scope is bounded to the parsing application itself (S:U) - app crash does not propagate to the OS kernel or other processes.

The overall real-world risk is moderate-to-low despite the cross-platform scope. CVSS 6.5 (Medium) is appropriate: the attack vector is network (file deliverable remotely), complexity is low, no privileges are required, but user interaction is mandatory (UI:R) - the victim must open the crafted file. The impact ceiling is app termination only (A:H, C:N, I:N), ruling out data theft or code execution at the CVSS-described scenario. EPSS at 0.02% (6th percentile) is extremely low, indicating the security community sees minimal exploitation probability. SSVC corroborates: exploitation status is 'none', the attack is not automatable, and technical impact is only 'partial'. No CISA KEV listing and no public proof-of-concept exist. The primary risk is a targeted social-engineering scenario where a victim is induced to open a malicious file, resulting in a crash - impactful in specific contexts (e.g., crash-looping a critical app on an unpatched device) but not enabling lateral movement or data exfiltration. The tags include 'Information Disclosure', which conflicts with the CVSS C:N metric - this label appears to be a tagging artifact and is not supported by the description or vector; treat it as unconfirmed.

An attacker crafts a malicious file exploiting the out-of-bounds read in Apple's file parser and delivers it to a target via email attachment, iMessage, a malicious website, or AirDrop. When the victim opens or previews the file on an unpatched Apple device, the parser reads beyond its allocated buffer and the application terminates unexpectedly. No public proof-of-concept exists, and given the low EPSS score and SSVC 'none' exploitation status, opportunistic mass exploitation is considered unlikely.