Apple OS CVE-2026-28991

Successful exploitation requires the victim to install and execute a malicious application on an unpatched Apple device running iOS/iPadOS, macOS, tvOS, visionOS, or watchOS versions below 26.5. While the CVSS vector indicates network attack vector (AV:N), practical exploitation is limited by Apple's application ecosystem controls: devices using default App Store-only installation policies have inherent protection through Apple's app review process, though vulnerabilities in the review process or compromised developer accounts could bypass this. Devices with developer mode enabled, jailbroken/rooted devices, or systems configured to allow sideloading face elevated risk. Enterprise-managed devices with strict MDM policies restricting application installations gain additional protective barriers. The vulnerability affects default system configurations once a malicious app gains execution privileges, requiring no special OS features to be enabled. User interaction is limited to the initial app launch decision, after which exploitation proceeds automatically (UI:N in CVSS vector).

Real-world exploitation risk is assessed as LOW-MODERATE despite the CVSS 7.5 HIGH score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible, low-complexity exploitation requiring no authentication, which typically signals significant risk. However, multiple mitigating factors reduce practical threat: EPSS score of 0.02% (5th percentile) indicates security researchers and threat actors assess actual exploitation probability as very low, no CISA KEV listing confirms no active exploitation campaigns detected, and impact is limited exclusively to availability (A:H) with no confidentiality or integrity compromise (C:N/I:N). The attack requires deploying a malicious application on the target device, which introduces friction despite the 'network' attack vector classification. CONFLICTING DATA POINT: Tags include 'Information Disclosure' while CVSS explicitly rates C:N (no confidentiality impact) - vendor advisories should be consulted to resolve this discrepancy. For organizations with comprehensive patch management, this represents a routine update cycle rather than emergency response. However, devices unable to upgrade to 26.5 (legacy hardware) face persistent denial-of-service risk from malicious apps.

An attacker distributes a malicious application through social engineering, phishing campaigns, or compromised third-party app repositories targeting users who sideload apps outside the official App Store. When the victim launches the malicious app on an unpatched Apple device (iOS/iPadOS, macOS, tvOS, visionOS, or watchOS prior to 26.5), the app triggers an out-of-bounds read condition in system memory through crafted API calls or data inputs. The memory access violation causes system instability, forcing device restart or rendering the device unresponsive, resulting in denial-of-service. The attack complexity is low with no user interaction required beyond initial app launch, and no authentication barriers protect against exploitation.