Apple iOS, iPadOS, macOS CVE-2026-28952

Requires a vulnerable application on the target device to accept and process attacker-controlled input containing overflow-triggering integer values. While the CVSS vector indicates network-accessible exploitation without authentication (AV:N/AC:L/PR:N/UI:N), the practical attack surface depends on what applications are installed and actively processing network data. The vulnerability exists in system-level components shared across iOS, iPadOS, and macOS, suggesting the overflow occurs in common frameworks invoked by applications rather than directly network-exposed services. Exploitation is limited to availability impact only (system crashes), not remote code execution, which reduces attacker incentive. Default installations of all affected Apple OS versions are vulnerable without special configuration requirements.

The CVSS score of 7.5 (High) reflects the network attack vector, low complexity, and high availability impact, but the complete absence of confidentiality and integrity impact (C:N/I:N/A:H) limits this to denial-of-service scenarios only. The CVSS metrics indicate remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N), which would typically raise concerns, but the EPSS score of 0.02% (5th percentile) suggests security researchers and threat actors view this as low priority for exploitation. No CISA KEV listing confirms absence of observed active exploitation. No public proof-of-concept code has been identified. The attack requires an application on the victim device to process malicious input, which adds a practical barrier despite the technical 'no user interaction' rating. Real-world risk is LOW to MODERATE - primarily relevant for organizations concerned about availability of Apple devices in critical roles or those facing targeted DoS threats. The availability of vendor patches across all affected platforms significantly reduces ongoing risk for patched systems.

A remote attacker identifies an application running on an unpatched Apple device that accepts network input. The attacker crafts malicious data containing integer values specifically designed to trigger overflow conditions when processed by vulnerable system components. When the application passes this input to the affected system framework, the integer overflow occurs, corrupting memory structures or triggering error conditions that cause the operating system to terminate unexpectedly, resulting in device crash and service disruption.