What is the CVSS score of CVE-2026-28959?

CVE-2026-28959 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple iOS are affected by CVE-2026-28959?

A vulnerability affecting all Apple operating systems-iOS, macOS, iPadOS, tvOS, visionOS, and watchOS-allows locally-installed malicious applications to crash systems and interrupt business…. A patch is available.

How to fix or mitigate CVE-2026-28959?

Within 24 hours, inventory all Apple devices managed or supported by your organization (Macs, iPhones, iPads, Apple Watches, Apple TVs, Vision Pro devices) and assess their current operating system versions against available patches. Within 7 days, deploy the latest Apple security updates across all affected platforms through your mobile device management solution and standard Mac update channels, ensuring iOS, iPadOS, macOS, tvOS, watchOS, and visionOS are all current with the latest available versions. Within 30 days, verify patch deployment compliance through your MDM and endpoint management tools, targeting 100% coverage, and establish a standard policy requiring deployment of Apple security updates within 14 days of their public release.

Apple iOS CVE-2026-28959

EUVD-2026-29264 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-11 apple

GHSA-jfcg-v87j-72gm

Buffer Overflow Apple Tvos Visionos Watchos Ios And Ipados

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Attacker must run a local app on the device (AV:L, PR:L); no user interaction beyond running the app; impact is crash-only, so C:N/I:N/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:43 vuln.today

CVSS changed

May 12, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

May 11, 2026 - 22:18 EUVD

CVE Published

May 11, 2026 - 20:07 nvd

HIGH 7.5

CVE Published

May 11, 2026 - 20:07 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

AnalysisAI

Denial of service in Apple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows a locally-installed malicious or malformed app to trigger a buffer overflow (CWE-120) that causes unexpected system termination. Impact is availability-only with no confirmed code execution or data disclosure. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and the flaw is not listed in CISA KEV; Apple has released fixes across all affected platforms.

Technical ContextAI

The defect is a classic buffer overflow (CWE-120, 'Buffer Copy without Checking Size of Input') that Apple states it addressed with 'improved bounds checking' - indicating an unchecked copy into a fixed-size buffer within a shared OS component present across the Apple platform family. The CPE data spans cpe:2.3:a:apple for ios_and_ipados, macos, tvos, visionos, and watchos, which is consistent with a vulnerability in a common framework or system library reused across all of Apple's operating systems rather than a single-platform bug. The observable outcome is memory corruption severe enough to abort the affected process or panic the system, but Apple's wording ('unexpected system termination') describes a crash rather than corrupted-memory-to-code-execution.

RemediationAI

Vendor-released patch: iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5 - update every affected device to the corresponding fixed build, prioritizing the legacy 18.7.x/14.8.x/15.7.x branches for fleets not yet on the 26.x line. Consult the matching Apple advisories at support.apple.com/en-us/127110-127120 to map each device model to its exact patched build. As a compensating control until patching, restrict app installation to trusted, reviewed sources (enforce MDM app allowlisting / Managed App configuration and disable sideloading and enterprise/developer provisioning profiles), since exploitation requires running an attacker-supplied app; the trade-off is reduced app flexibility for users, but it directly removes the local delivery path for this DoS.