Apple iOS/iPadOS/macOS/visionOS CVE-2026-28936

Remote exploitation requires victim to receive and process a maliciously crafted file through any file-handling application on affected Apple platforms (Mail, Messages, Safari, Files, Preview, or third-party apps using Apple's file parsing frameworks). Despite CVSS UI:N rating, practical exploitation requires file delivery mechanism and processing trigger-either automatic preview/thumbnail generation (no explicit user interaction) or user opening the file. The vulnerability affects default configurations with no special features requiring enablement. Exploitation limited by need for attacker to deliver file payload and depends on which application processes it, as different apps may have varying access to sensitive information. Network attack vector indicates remote delivery but actual information disclosure occurs locally during file processing, not over network connection.

Risk assessment reveals significant discrepancy between vulnerability scoring and real-world exploitation signals. CVSS 7.5 indicates high severity with network vector, low complexity, no authentication, and no user interaction required (AV:N/AC:L/PR:N/UI:N), suggesting trivially exploitable remote attack. However, EPSS 0.02% (5th percentile) indicates security community assesses actual exploitation likelihood as negligible. This contradiction likely stems from practical exploitation constraints not captured in CVSS: the requirement to process a malicious file (despite UI:N rating) means exploitation depends on application-specific attack surface-email attachments, web downloads, or document viewers. Not present in CISA KEV confirms no widespread or targeted exploitation detected. SSVC factors show exploitation=none, technical impact=partial (confidentiality only), likely non-automatable at scale. Primary risk is targeted attacks against high-value individuals using social engineering to deliver malicious files through Messages, Mail, Safari downloads, or AirDrop. For most organizations, this represents lower priority than the CVSS score suggests, but high-security environments handling sensitive data on Apple devices should prioritize patching.

Attacker crafts a malicious file exploiting input validation weaknesses in Apple's file parsing framework. Victim receives file through Messages, Mail attachment, AirDrop, or downloads via Safari. Upon processing (preview generation, thumbnail creation, or user opening), the file triggers the validation flaw, allowing attacker to extract high-value confidential information from device memory or filesystem before the application terminates. Extracted data could include authentication tokens, encryption keys, cached credentials, or sensitive document contents depending on the vulnerable application's privilege level.