Skip to main content

Apple WebKit CVE-2026-28955

| EUVDEUVD-2026-29260 HIGH
Buffer Overflow (CWE-119)
2026-05-11 apple GHSA-q34x-fmmg-9c36
Buffer Overflow Apple Tvos Visionos Watchos Ios And Ipados
8.8
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim to malicious page
  2. Delivery
    Deliver crafted web content
  3. Exploit
    Trigger out-of-bounds memory access in WebKit
  4. Execution
    Corrupt renderer process memory
  5. Impact
    Crash web content process (potential code execution unconfirmed)

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to process attacker-controlled web content - i.e. open or be redirected to a malicious page in Safari or an app embedding WebKit (WKWebView); this maps to the CVSS UI:R requirement, so it is not fully drive-by without any interaction. No authentication or prior access to the device is needed (PR:N), and no special non-default configuration is required beyond having web browsing/WebView functionality enabled, which is the default. Limiting factors: the target must actively load the malicious content, the device must be running an affected version below the fixed release, and per Apple's description the demonstrated outcome is a process crash rather than confirmed code execution, which bounds realistic impact absent further weaponization.
Impact

Signals are mixed and should be read together rather than off the raw 8.8 score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) frames this as network-reachable, low-complexity, unauthenticated but requiring user interaction (visiting a page), with full CIA impact - however Apple's own description only claims 'an unexpected process crash,' which maps to availability, not confidentiality or integrity; this discrepancy should be verified against Apple's advisory before treating it as an RCE/info-leak. Supporting a lower real-world priority: EPSS is 0.03% (10th percentile), it is not on CISA KEV, no POC is referenced, and SSVC records Exploitation=none with Technical Impact=partial. The one aggravating SSVC signal is Automatable=yes (drive-by web delivery scales easily). Net: a broadly deployed but low-current-threat memory bug - patch on normal cadence rather than emergency unless the C:H/I:H claim is confirmed as code execution.
Exploit ScenarioDerived

An attacker hosts a page containing crafted web content and lures a target into opening it in Safari or any in-app WebView (via a link in a message, email or ad). When the engine parses the malicious markup/script it triggers the out-of-bounds memory access, at minimum crashing the web content process; if the fuller CIA impact in the CVSS vector holds, the same corruption could be developed toward code execution in the renderer. No public POC is referenced at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Memory-safety corruption (CWE-119) in Apple's web content engine allows a remote attacker who lures a victim to a malicious page to crash the WebKit rendering process across iOS/iPadOS, macOS Tahoe, tvOS, visionOS and watchOS. Reported by Apple and fixed in iOS/iPadOS 18.7.9 and 26.5 and the 26.5 releases of the other platforms; there is no public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC records exploitation status as none. Note a signal conflict: the NVD vector claims full confidentiality/integrity/availability impact (C:H/I:H/A:H) while Apple's description substantiates only 'an unexpected process crash.'

RemediationAI

Vendor-released patch: update to iOS 18.7.9 / iPadOS 18.7.9, or iOS 26.5 / iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5, following the matching Apple advisory (support.apple.com/en-us/127110 through 127121 for the specific platform). Because the fix is a memory-handling correction inside WebKit there is no reliable configuration-only workaround; as interim compensating controls you can disable JavaScript in Safari (Settings > Safari > Advanced) which breaks most modern sites, restrict browsing to trusted sites or route traffic through a filtering proxy/MDM web-content policy to reduce exposure to malicious pages, and enable Lockdown Mode on high-risk devices (which aggressively restricts WebKit features at the cost of usability). These controls only lower the odds of reaching the vulnerable code path and are not substitutes for installing the patched OS version.

Affected VersionsENISA

visionOS 0 <26.5
watchOS 0 <26.5
tvOS 0 <26.5
iOS and iPadOS 0 <18.7.9
macOS 0 <26.5
iOS and iPadOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 18.7.9, 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw is in the code path that processes untrusted web content, i.e. Apple's WebKit browser/rendering engine that backs Safari, the in-app WebView (WKWebView) and any component that renders HTML/JavaScript across all listed operating systems. CWE-119 (improper restriction of operations within the bounds of a memory buffer) and the 'Buffer Overflow' tag indicate the root cause is an out-of-bounds memory access when parsing or laying out crafted markup, script or media. Apple states it was 'addressed with improved memory handling,' which is Apple's standard phrasing for bounds/allocation hardening in the affected parser. The CPE set (apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos) confirms the shared engine spans the entire Apple OS family.

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 4.3 MEDIUM

Network-delivered web content with required user interaction (UI:R); Apple substantiates only a single-process crash, so C:N/I:N and A:L rather than the NVD C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.5 (HIGH) 8.8 (HIGH)
CVSS changed
May 12, 2026 - 20:22 NVD
7.5 (HIGH)
Patch available
May 11, 2026 - 22:18 EUVD
CVE Published
May 11, 2026 - 20:07 nvd
HIGH 7.5
CVE Published
May 11, 2026 - 20:07 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:07 cve.org
HIGH 8.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Zero Day Initiative Advisories

ZDI-26-312 Apple Safari Web Inspector WebCore Style Resolver Use-After-Free Remote Code Execution Vulnerability May 2026

Executive ViewAI

Why It Matters

A vulnerability in Apple's web engine (CVE-2026-28955) affects all Apple platforms and causes web browsers to temporarily stop responding when users visit malicious sites; while formally scored as high-severity, real-world exploitation risk is extremely low (EPSS 0.03%, no active attacks), limiting the impact to periodic application disruptions rather than data loss.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Prevalence
Ubiquitous
WebKit ships in every iPhone, iPad, Mac and Apple wearable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Medium
Technical Impact
Partial

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28955 ADVISORY https://vuldb.com/vuln/362821 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28955 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483966 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28955.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127111 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121 REF https://www.zerodayinitiative.com/advisories/ZDI-26-312/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy