Apple iOS CVE-2026-28940

Exploitation requires the victim to process a maliciously crafted image in an affected Apple OS (iOS/iPadOS before 18.7.9 or 26.5, macOS before 15.7.7/26.5, tvOS before 26.5, visionOS before 26.5); this is the specific prerequisite - the image must be opened or automatically rendered by an image-processing component. No authentication is required (PR:N) and it works against default configurations, but the attack is LIMITED by required user interaction (UI:R): a target must receive and render the attacker's image, so there is no fully unattended network exploitation. The exact code path/trigger inside the image parser is not described in the available sources.

Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a remotely reachable, unauthenticated, low-complexity memory-corruption flaw that still requires user interaction (UI:R) - namely processing a malicious image. Against that, EPSS is very low at 0.02% (7th percentile), the vulnerability is NOT in CISA KEV, and the CISA SSVC framework records Exploitation: none, Automatable: yes, Technical Impact: partial. The vuln.today priority is 'this_week' (not act_now/emergency). These softer signals contrast with the high CVSS: the severity reflects potential impact (memory corruption that could lead to code execution with high C/I/A) rather than observed exploitation. A ZDI advisory (ZDI-26-314) is referenced, so a public PoC reference exists; it is not verified as working exploit code, and the SSVC 'Exploitation: none' label indicates no confirmed exploitation. The 'Automatable: yes' SSVC value conflicts somewhat with the CVSS UI:R requirement - automation of delivery is plausible (e.g. embedding the image in content), but a user/target must still render the image, so mass unattended exploitation is constrained. Net: a genuine high-severity client-side bug worth patching on the vendor's 'this_week' cadence, but not an emergency, with no evidence of real-world exploitation at time of analysis.

An attacker crafts a malicious image and delivers it to a victim via a message, email, webpage, or file; when the victim's Apple device processes (renders) the image, the malformed data corrupts process memory. A ZDI advisory reference (ZDI-26-314) exists but is not verified as working exploit code; successful exploitation could enable attacker-controlled memory corruption consistent with the high confidentiality, integrity, and availability impact in the CVSS vector.