What is the CVSS score of CVE-2026-28973?

CVE-2026-28973 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apple iOS are affected by CVE-2026-28973?

A high-severity local vulnerability in Apple iOS, iPadOS, macOS, and watchOS (CVE-2026-28973) allows malicious applications to bypass security boundaries and gain unauthorized system access.. A patch is available.

How to fix or mitigate CVE-2026-28973?

Within 24 hours, audit your environment to identify all Apple iOS, iPadOS, macOS, and watchOS devices and confirm availability of the latest patches from Apple's security updates. Within 7 days, test patches in a pilot group and deploy through your mobile device management or patch management system, prioritizing devices with administrative or sensitive data access. Within 30 days, achieve 100% patch coverage across all affected devices, establish patch compliance reporting, and automate Apple security updates in your ongoing patch management program.

Apple iOS CVE-2026-28973

EUVD-2026-49511 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-07-27 apple

GHSA-q9xv-pwq9-9x39

Apple Buffer Overflow Integer Overflow Ios And Ipados Watchos

8.6

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.6 HIGH

A local malicious app (AV:L) run by the user (UI:R, PR:N) triggers a sandbox escape crossing a trust boundary (S:C) with full C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:23 vuln.today

CVSS changed

Jul 28, 2026 - 15:22 NVD

8.6 (HIGH)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

HIGH 8.6

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, watchOS 26.6. A malicious app may be able to break out of its sandbox.

AnalysisAI

Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.

Technical ContextAI

The flaw is an integer overflow (CWE-190) - an arithmetic operation producing a value outside the representable range - which Apple states was addressed with improved input validation. Such overflows typically cause undersized allocations or out-of-bounds memory access (the tags also cite Buffer Overflow), which in a sandboxed-app context can be leveraged to escape the app sandbox that normally confines third-party applications on Apple platforms. The CPE data confirms the affected code spans Apple's shared OS foundations across ios_and_ipados, macos, and watchos, indicating the vulnerable component is common cross-platform Apple OS code rather than a single app.

RemediationAI

Vendor-released patch: update to iOS 26.6, iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, or watchOS 26.6 as applicable to each device, via Software Update or MDM; the corresponding advisories are at support.apple.com/en-us/128066, 128067, 128068, 128071, and 128072. Because exploitation requires running a malicious app, an interim compensating control is to restrict installation to the App Store and vetted MDM-managed apps, disable sideloading and enterprise-signed app trust, and avoid installing untrusted applications until patched - the trade-off is reduced flexibility for internally distributed enterprise apps.