Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-28917 (GCVE-0-2026-28917)
Vulnerability from cvelistv5 – Published: 2026-05-11 20:08 – Updated: 2026-05-13 19:58
VLAI
EPSS
VEX
Summary
The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 18:11 UTC
CWE
- Processing maliciously crafted web content may lead to an unexpected process crash
- CWE-20 - Improper Input Validation
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Apple | Safari |
Affected:
0 , < 26.5
(custom)
|
guessed | |
| Apple | iOS and iPadOS |
Affected:
0 , < 18.7.9
(custom)
Affected: 0 , < 26.5 (custom) |
guessed | |
| Apple | macOS |
Affected:
0 , < 26.5
(custom)
|
guessed | |
| Apple | tvOS |
Affected:
0 , < 26.5
(custom)
|
guessed | |
| Apple | visionOS |
Affected:
0 , < 26.5
(custom)
|
guessed | |
| Apple | watchOS |
Affected:
0 , < 26.5
(custom)
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T18:11:35.815328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T18:11:41.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing maliciously crafted web content may lead to an unexpected process crash",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T19:58:58.360Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/127110"
},
{
"url": "https://support.apple.com/en-us/127111"
},
{
"url": "https://support.apple.com/en-us/127115"
},
{
"url": "https://support.apple.com/en-us/127118"
},
{
"url": "https://support.apple.com/en-us/127119"
},
{
"url": "https://support.apple.com/en-us/127120"
},
{
"url": "https://support.apple.com/en-us/127121"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-28917",
"datePublished": "2026-05-11T20:08:46.938Z",
"dateReserved": "2026-03-03T16:36:03.985Z",
"dateUpdated": "2026-05-13T19:58:58.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-28917",
"date": "2026-09-11",
"epss": "0.00296",
"percentile": "0.22007"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-28917\",\"sourceIdentifier\":\"product-security@apple.com\",\"published\":\"2026-05-11T21:18:54.110\",\"lastModified\":\"2026-06-17T10:29:20.500\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\"}],\"affected\":[{\"source\":\"product-security@apple.com\",\"affectedData\":[{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.5\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"18.7.9\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"26.5\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.5\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.5\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.5\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.5\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-12T18:11:35.815328Z\",\"id\":\"CVE-2026-28917\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"18.7.9\",\"matchCriteriaId\":\"F3968B76-E6DE-416D-A0FB-E4833FFAAE0F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"26.0\",\"versionEndExcluding\":\"26.5\",\"matchCriteriaId\":\"20644D7E-2AB6-48CA-AED4-C474A9867986\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"18.7.9\",\"matchCriteriaId\":\"B6431EAF-B395-4C19-9AB6-A2F45991C897\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"26.0\",\"versionEndExcluding\":\"26.5\",\"matchCriteriaId\":\"1BE54A3B-D667-43BA-AB71-BCF8438054E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"26.0\",\"versionEndExcluding\":\"26.5\",\"matchCriteriaId\":\"6CB91417-90A8-4A9B-A1D0-1D94B80EF837\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.5\",\"matchCriteriaId\":\"176C47FD-FA25-437B-9061-A81CAA367AEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.5\",\"matchCriteriaId\":\"C8F45D80-0DF8-444E-9AF1-703A1075F046\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.5\",\"matchCriteriaId\":\"057B244F-5485-4108-8E23-FE15F5256EE7\"}]}]}],\"references\":[{\"url\":\"https://support.apple.com/en-us/127110\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/127111\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/127115\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/127118\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/127119\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/127120\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/127121\",\"source\":\"product-security@apple.com\"}]}}",
"redhat_vex": {
"current_release_date": "2026-05-14T02:21:48+00:00",
"cve": "CVE-2026-28917",
"id": "CVE-2026-28917",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "CVE-2026-28917",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28917.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-28917\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-12T18:11:35.815328Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-12T18:11:31.640Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Apple\", \"product\": \"Safari\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"iOS and iPadOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"18.7.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"macOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"tvOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"visionOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"watchOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.5\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://support.apple.com/en-us/127110\"}, {\"url\": \"https://support.apple.com/en-us/127111\"}, {\"url\": \"https://support.apple.com/en-us/127115\"}, {\"url\": \"https://support.apple.com/en-us/127118\"}, {\"url\": \"https://support.apple.com/en-us/127119\"}, {\"url\": \"https://support.apple.com/en-us/127120\"}, {\"url\": \"https://support.apple.com/en-us/127121\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"Processing maliciously crafted web content may lead to an unexpected process crash\"}]}], \"providerMetadata\": {\"orgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"shortName\": \"apple\", \"dateUpdated\": \"2026-05-13T19:58:58.360Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-28917\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-13T19:58:58.360Z\", \"dateReserved\": \"2026-03-03T16:36:03.985Z\", \"assignerOrgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"datePublished\": \"2026-05-11T20:08:46.938Z\", \"assignerShortName\": \"apple\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
CERTFR-2026-AVI-0563
Vulnerability from certfr_avis - Published: 2026-05-12 - Updated: 2026-05-12
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | iPadOS | iPadOS versions antérieures à 26.5 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.7.7 | ||
| Apple | iPadOS | iPadOS versions antérieures à 15.8.8 | ||
| Apple | macOS | macOS Sonoma versions antérieures à 14.8.7 | ||
| Apple | iPadOS | iPadOS versions antérieures à 17.7.11 | ||
| Apple | iPadOS | iPadOS versions antérieures à 18.7.9 | ||
| Apple | tvOS | tvOS versions antérieures à 26.5 | ||
| Apple | visionOS | visionOS versions antérieures à 26.5 | ||
| Apple | iPadOS | iPadOS versions antérieures à 16.7.16 | ||
| Apple | iOS | iOS versions antérieures à 16.7.16 | ||
| Apple | iOS | iOS versions antérieures à 18.7.9 | ||
| Apple | iOS | iOS versions antérieures à 26.5 | ||
| Apple | macOS | macOS Tahoe versions antérieures à 26.5 | ||
| Apple | watchOS | watchOS versions antérieures à 26.5 | ||
| Apple | iOS | iOS versions antérieures à 15.8.8 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26.5",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7.7",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 15.8.8",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8.7",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 17.7.11",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 18.7.9",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 26.5",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 26.5",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 16.7.16",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 16.7.16",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 18.7.9",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": " iOS versions ant\u00e9rieures \u00e0 26.5",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.5",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 26.5",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 15.8.8",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-43668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43668"
},
{
"name": "CVE-2026-28944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28944"
},
{
"name": "CVE-2026-1837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1837"
},
{
"name": "CVE-2026-28930",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28930"
},
{
"name": "CVE-2026-28976",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28976"
},
{
"name": "CVE-2026-43656",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43656"
},
{
"name": "CVE-2026-28988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28988"
},
{
"name": "CVE-2026-28951",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28951"
},
{
"name": "CVE-2026-28901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28901"
},
{
"name": "CVE-2026-28915",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28915"
},
{
"name": "CVE-2026-28965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28965"
},
{
"name": "CVE-2026-28913",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28913"
},
{
"name": "CVE-2026-28987",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28987"
},
{
"name": "CVE-2026-28994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28994"
},
{
"name": "CVE-2026-28919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28919"
},
{
"name": "CVE-2026-28882",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28882"
},
{
"name": "CVE-2026-43661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43661"
},
{
"name": "CVE-2026-28959",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28959"
},
{
"name": "CVE-2026-28873",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28873"
},
{
"name": "CVE-2026-28947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28947"
},
{
"name": "CVE-2026-43658",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43658"
},
{
"name": "CVE-2026-28840",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28840"
},
{
"name": "CVE-2026-28920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28920"
},
{
"name": "CVE-2026-28878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28878"
},
{
"name": "CVE-2026-39871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39871"
},
{
"name": "CVE-2026-28961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28961"
},
{
"name": "CVE-2026-28907",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28907"
},
{
"name": "CVE-2026-39869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39869"
},
{
"name": "CVE-2025-43524",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43524"
},
{
"name": "CVE-2026-28953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28953"
},
{
"name": "CVE-2026-39870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39870"
},
{
"name": "CVE-2026-28963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28963"
},
{
"name": "CVE-2026-28936",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28936"
},
{
"name": "CVE-2026-28955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28955"
},
{
"name": "CVE-2026-28977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28977"
},
{
"name": "CVE-2026-28940",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28940"
},
{
"name": "CVE-2026-28903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28903"
},
{
"name": "CVE-2026-28969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28969"
},
{
"name": "CVE-2026-28848",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28848"
},
{
"name": "CVE-2026-28957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28957"
},
{
"name": "CVE-2026-28819",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28819"
},
{
"name": "CVE-2026-28872",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28872"
},
{
"name": "CVE-2026-28846",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28846"
},
{
"name": "CVE-2026-28902",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28902"
},
{
"name": "CVE-2026-28917",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28917"
},
{
"name": "CVE-2026-28964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28964"
},
{
"name": "CVE-2026-28894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28894"
},
{
"name": "CVE-2026-28950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28950"
},
{
"name": "CVE-2026-28986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28986"
},
{
"name": "CVE-2026-28925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28925"
},
{
"name": "CVE-2026-28943",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28943"
},
{
"name": "CVE-2026-28993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28993"
},
{
"name": "CVE-2026-28924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28924"
},
{
"name": "CVE-2026-28990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28990"
},
{
"name": "CVE-2026-28918",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28918"
},
{
"name": "CVE-2026-28996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28996"
},
{
"name": "CVE-2026-28905",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28905"
},
{
"name": "CVE-2026-28906",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28906"
},
{
"name": "CVE-2026-43655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43655"
},
{
"name": "CVE-2026-28972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28972"
},
{
"name": "CVE-2026-28941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28941"
},
{
"name": "CVE-2026-28954",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28954"
},
{
"name": "CVE-2026-28877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28877"
},
{
"name": "CVE-2026-28956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28956"
},
{
"name": "CVE-2026-28974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28974"
},
{
"name": "CVE-2026-43652",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43652"
},
{
"name": "CVE-2026-28908",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28908"
},
{
"name": "CVE-2026-43654",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43654"
},
{
"name": "CVE-2026-28929",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28929"
},
{
"name": "CVE-2026-28971",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28971"
},
{
"name": "CVE-2026-28985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28985"
},
{
"name": "CVE-2026-28958",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28958"
},
{
"name": "CVE-2026-28995",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28995"
},
{
"name": "CVE-2026-28922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28922"
},
{
"name": "CVE-2026-43653",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43653"
},
{
"name": "CVE-2026-28914",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28914"
},
{
"name": "CVE-2026-28942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28942"
},
{
"name": "CVE-2026-28946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28946"
},
{
"name": "CVE-2026-28991",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28991"
},
{
"name": "CVE-2026-28952",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28952"
},
{
"name": "CVE-2026-28962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28962"
},
{
"name": "CVE-2026-28983",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28983"
},
{
"name": "CVE-2026-43660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43660"
},
{
"name": "CVE-2026-28904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28904"
},
{
"name": "CVE-2026-28978",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28978"
},
{
"name": "CVE-2026-28992",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28992"
},
{
"name": "CVE-2026-43659",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43659"
},
{
"name": "CVE-2026-28923",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28923"
},
{
"name": "CVE-2026-28870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28870"
},
{
"name": "CVE-2026-43666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43666"
},
{
"name": "CVE-2026-28897",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28897"
},
{
"name": "CVE-2026-28883",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28883"
},
{
"name": "CVE-2026-28847",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28847"
}
],
"initial_release_date": "2026-05-12T00:00:00",
"last_revision_date": "2026-05-12T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0563",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-05-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127114",
"url": "https://support.apple.com/en-us/127114"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127117",
"url": "https://support.apple.com/en-us/127117"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127115",
"url": "https://support.apple.com/en-us/127115"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127118",
"url": "https://support.apple.com/en-us/127118"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127110",
"url": "https://support.apple.com/en-us/127110"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127111",
"url": "https://support.apple.com/en-us/127111"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127113",
"url": "https://support.apple.com/en-us/127113"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127116",
"url": "https://support.apple.com/en-us/127116"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127119",
"url": "https://support.apple.com/en-us/127119"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127120",
"url": "https://support.apple.com/en-us/127120"
},
{
"published_at": "2026-05-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127112",
"url": "https://support.apple.com/en-us/127112"
}
]
}
CERTFR-2026-AVI-0590
Vulnerability from certfr_avis - Published: 2026-05-15 - Updated: 2026-05-15
De multiples vulnérabilités ont été découvertes dans Apple Safari. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Safari versions ant\u00e9rieures \u00e0 26.5",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-28944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28944"
},
{
"name": "CVE-2026-28901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28901"
},
{
"name": "CVE-2026-28913",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28913"
},
{
"name": "CVE-2026-28947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28947"
},
{
"name": "CVE-2026-43658",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43658"
},
{
"name": "CVE-2026-28907",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28907"
},
{
"name": "CVE-2026-28953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28953"
},
{
"name": "CVE-2026-28955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28955"
},
{
"name": "CVE-2026-28903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28903"
},
{
"name": "CVE-2026-28902",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28902"
},
{
"name": "CVE-2026-28917",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28917"
},
{
"name": "CVE-2026-28905",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28905"
},
{
"name": "CVE-2026-28971",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28971"
},
{
"name": "CVE-2026-28958",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28958"
},
{
"name": "CVE-2026-28942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28942"
},
{
"name": "CVE-2026-28946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28946"
},
{
"name": "CVE-2026-28962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28962"
},
{
"name": "CVE-2026-43660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43660"
},
{
"name": "CVE-2026-28904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28904"
},
{
"name": "CVE-2026-28883",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28883"
},
{
"name": "CVE-2026-28847",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28847"
}
],
"initial_release_date": "2026-05-15T00:00:00",
"last_revision_date": "2026-05-15T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0590",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-05-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apple Safari. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple Safari",
"vendor_advisories": [
{
"published_at": "2026-05-13",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 127121",
"url": "https://support.apple.com/en-us/127121"
}
]
}
FKIE_CVE-2026-28917
Vulnerability from fkie_nvd - Published: 2026-05-11 21:18 - Updated: 2026-06-17 10:29
Severity
Summary
The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
References
| URL | Tags | ||
|---|---|---|---|
| product-security@apple.com | https://support.apple.com/en-us/127110 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/127111 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/127115 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/127118 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/127119 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/127120 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/127121 |
{
"affected": [
{
"affectedData": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "product-security@apple.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F3968B76-E6DE-416D-A0FB-E4833FFAAE0F",
"versionEndExcluding": "18.7.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "20644D7E-2AB6-48CA-AED4-C474A9867986",
"versionEndExcluding": "26.5",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B6431EAF-B395-4C19-9AB6-A2F45991C897",
"versionEndExcluding": "18.7.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1BE54A3B-D667-43BA-AB71-BCF8438054E0",
"versionEndExcluding": "26.5",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6CB91417-90A8-4A9B-A1D0-1D94B80EF837",
"versionEndExcluding": "26.5",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "176C47FD-FA25-437B-9061-A81CAA367AEF",
"versionEndExcluding": "26.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C8F45D80-0DF8-444E-9AF1-703A1075F046",
"versionEndExcluding": "26.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "057B244F-5485-4108-8E23-FE15F5256EE7",
"versionEndExcluding": "26.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash."
}
],
"id": "CVE-2026-28917",
"lastModified": "2026-06-17T10:29:20.500",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-28917",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T18:11:35.815328Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-11T21:18:54.110",
"references": [
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127110"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127111"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127115"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127118"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127119"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/127120"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/127121"
}
],
"sourceIdentifier": "product-security@apple.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
GCVE-1988-2026-0328
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
APPLE-SA-05-11-2026-1 iOS 26.5 and iPadOS 26.5
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-1 iOS 26.5 and iPadOS 26.5
iOS 26.5 and iPadOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127110.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-28991: Seiji Sakurai (@HeapSmasher)
Accounts
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to bypass certain Privacy preferences
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28988: Asaf Cohen
APFS
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28959: Dave G.
App Intents
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A malicious app may be able to break out of its sandbox
Description: A logic issue was addressed with improved restrictions.
CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society
AppleJPEG
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may lead to a
denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-1837
AppleJPEG
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted media file may lead to
unexpected app termination or corrupt process memory
Description: A memory corruption issue was addressed with improved input
validation.
CVE-2026-28956: impost0r (ret2plt)
Audio
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: The issue was addressed with improved memory handling.
CVE-2026-39869: David Ige of Beryllium Security
CoreAnimation
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2026-28964: Alan Wang, Christopher W. Fletcher, Hovav Shacham, David
Kohlbrenner, Riccardo Paccagnella
CoreServices
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved checks.
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CoreSymbolication
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day
Initiative
FileProvider
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-43659: Alex Radocea
ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: A buffer overflow issue was addressed with improved memory
handling.
CVE-2026-43661: an anonymous researcher
ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-28977: Suresh Sundaram
ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28990: Jiri Ha, Arni Hardarson
IOHIDFamily
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker may be able to cause unexpected app termination
Description: A memory corruption vulnerability was addressed with
improved locking.
CVE-2026-28992: Johnny Franks (@zeroxjf)
IOHIDFamily
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to determine kernel memory layout
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28943: Google Threat Analysis Group
IOKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar
IOSurfaceAccelerator
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43655: Somair Ansar and an anonymous researcher
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A buffer overflow was addressed with improved input
validation.
CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar
Gokulakannan
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to gain root privileges
Description: An authorization issue was addressed with improved state
management.
CVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with additional validation.
CVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence
Security, Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to leak sensitive kernel state
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)
LaunchServices
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A remote attacker may be able to cause a denial of service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-28983: Ruslan Dautov
mDNSResponder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker on the local netwo
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | APPLE-SA-05-11-2026-1 iOS |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0328 (this record)
- related CVE-2026-1837
- related CVE-2026-28846
- related CVE-2026-28847
- related CVE-2026-28883
- related CVE-2026-28897
- related CVE-2026-28901
- related CVE-2026-28902
- related CVE-2026-28903
- related CVE-2026-28904
- related CVE-2026-28905
- related CVE-2026-28906
- related CVE-2026-28907
- related CVE-2026-28913
- related CVE-2026-28917
- related CVE-2026-28918
- related CVE-2026-28920
- related CVE-2026-28936
- related CVE-2026-28940
- related CVE-2026-28942
- related CVE-2026-28943
- related CVE-2026-28944
- related CVE-2026-28947
- related CVE-2026-28951
- related CVE-2026-28953
- related CVE-2026-28955
- related CVE-2026-28956
- related CVE-2026-28957
- related CVE-2026-28958
- related CVE-2026-28959
- related CVE-2026-28962
- related CVE-2026-28963
- related CVE-2026-28964
- related CVE-2026-28965
- related CVE-2026-28969
- related CVE-2026-28971
- related CVE-2026-28972
- related CVE-2026-28974
- related CVE-2026-28977
- related CVE-2026-28983
- related CVE-2026-28985
- related CVE-2026-28986
- related CVE-2026-28987
- related CVE-2026-28988
- related CVE-2026-28990
- related CVE-2026-28991
- related CVE-2026-28992
- related CVE-2026-28993
- related CVE-2026-28994
- related CVE-2026-28995
- related CVE-2026-28996
- related CVE-2026-39869
- related CVE-2026-43653
- related CVE-2026-43654
- related CVE-2026-43655
- related CVE-2026-43656
- related CVE-2026-43658
- related CVE-2026-43659
- related CVE-2026-43660
- related CVE-2026-43661
- related CVE-2026-43666
- related CVE-2026-43668
{
"containers": {
"cna": {
"affected": [
{
"product": "APPLE-SA-05-11-2026-1 iOS",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-1 iOS 26.5 and iPadOS 26.5\n\niOS 26.5 and iPadOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127110.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreAnimation\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-28964: Alan Wang, Christopher W. Fletcher, Hovav Shacham, David\nKohlbrenner, Riccardo Paccagnella\n\nCoreServices\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreSymbolication\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nFileProvider\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to gain root privileges\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker on the local netwo"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:55Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/5"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/5"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/en-us/127110"
},
{
"url": "https://www.apple.com/itunes/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/5"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-05-11-2026-1 iOS 26.5 and iPadOS 26.5",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-1837",
"type": "related"
},
{
"destId": "CVE-2026-28846",
"type": "related"
},
{
"destId": "CVE-2026-28847",
"type": "related"
},
{
"destId": "CVE-2026-28883",
"type": "related"
},
{
"destId": "CVE-2026-28897",
"type": "related"
},
{
"destId": "CVE-2026-28901",
"type": "related"
},
{
"destId": "CVE-2026-28902",
"type": "related"
},
{
"destId": "CVE-2026-28903",
"type": "related"
},
{
"destId": "CVE-2026-28904",
"type": "related"
},
{
"destId": "CVE-2026-28905",
"type": "related"
},
{
"destId": "CVE-2026-28906",
"type": "related"
},
{
"destId": "CVE-2026-28907",
"type": "related"
},
{
"destId": "CVE-2026-28913",
"type": "related"
},
{
"destId": "CVE-2026-28917",
"type": "related"
},
{
"destId": "CVE-2026-28918",
"type": "related"
},
{
"destId": "CVE-2026-28920",
"type": "related"
},
{
"destId": "CVE-2026-28936",
"type": "related"
},
{
"destId": "CVE-2026-28940",
"type": "related"
},
{
"destId": "CVE-2026-28942",
"type": "related"
},
{
"destId": "CVE-2026-28943",
"type": "related"
},
{
"destId": "CVE-2026-28944",
"type": "related"
},
{
"destId": "CVE-2026-28947",
"type": "related"
},
{
"destId": "CVE-2026-28951",
"type": "related"
},
{
"destId": "CVE-2026-28953",
"type": "related"
},
{
"destId": "CVE-2026-28955",
"type": "related"
},
{
"destId": "CVE-2026-28956",
"type": "related"
},
{
"destId": "CVE-2026-28957",
"type": "related"
},
{
"destId": "CVE-2026-28958",
"type": "related"
},
{
"destId": "CVE-2026-28959",
"type": "related"
},
{
"destId": "CVE-2026-28962",
"type": "related"
},
{
"destId": "CVE-2026-28963",
"type": "related"
},
{
"destId": "CVE-2026-28964",
"type": "related"
},
{
"destId": "CVE-2026-28965",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-28971",
"type": "related"
},
{
"destId": "CVE-2026-28972",
"type": "related"
},
{
"destId": "CVE-2026-28974",
"type": "related"
},
{
"destId": "CVE-2026-28977",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-28985",
"type": "related"
},
{
"destId": "CVE-2026-28986",
"type": "related"
},
{
"destId": "CVE-2026-28987",
"type": "related"
},
{
"destId": "CVE-2026-28988",
"type": "related"
},
{
"destId": "CVE-2026-28990",
"type": "related"
},
{
"destId": "CVE-2026-28991",
"type": "related"
},
{
"destId": "CVE-2026-28992",
"type": "related"
},
{
"destId": "CVE-2026-28993",
"type": "related"
},
{
"destId": "CVE-2026-28994",
"type": "related"
},
{
"destId": "CVE-2026-28995",
"type": "related"
},
{
"destId": "CVE-2026-28996",
"type": "related"
},
{
"destId": "CVE-2026-39869",
"type": "related"
},
{
"destId": "CVE-2026-43653",
"type": "related"
},
{
"destId": "CVE-2026-43654",
"type": "related"
},
{
"destId": "CVE-2026-43655",
"type": "related"
},
{
"destId": "CVE-2026-43656",
"type": "related"
},
{
"destId": "CVE-2026-43658",
"type": "related"
},
{
"destId": "CVE-2026-43659",
"type": "related"
},
{
"destId": "CVE-2026-43660",
"type": "related"
},
{
"destId": "CVE-2026-43661",
"type": "related"
},
{
"destId": "CVE-2026-43666",
"type": "related"
},
{
"destId": "CVE-2026-43668",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0328",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/5",
"automated": true,
"contentSha256": "3731d3658b9f4895ac721f95beab08818aa2e4386ca7096b31aa96adfe78ec37",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/5",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-11T22:28:37Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0328"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:55Z",
"dateUpdated": "2026-09-11T07:55:55Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0328"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0329
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
APPLE-SA-05-11-2026-2 iOS 18.7.9 and iPadOS 18.7.9
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-2 iOS 18.7.9 and iPadOS 18.7.9
iOS 18.7.9 and iPadOS 18.7.9 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127111.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-28877: Rosyna Keller of Totally Not Malicious Software
APFS
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28959: Dave G.
App Intents
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A malicious app may be able to break out of its sandbox
Description: A logic issue was addressed with improved restrictions.
CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society
Audio
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: The issue was addressed with improved memory handling.
CVE-2026-39869: David Ige of Beryllium Security
Calendar
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue was addressed with improved
input validation.
CVE-2026-28872: Alvin Aries Tapia
Calling Framework
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A remote attacker may be able to cause a denial-of-service
Description: A denial-of-service issue was addressed with improved input
validation.
CVE-2026-28894: an anonymous researcher
CoreServices
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved checks.
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
FileProvider
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-43659: Alex Radocea
GeoServices
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to access sensitive user data
Description: An information leakage was addressed with additional
validation.
CVE-2026-28870: XiguaSec
ImageIO
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-28977: Suresh Sundaram
IOHIDFamily
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An attacker may be able to cause unexpected app termination
Description: A memory corruption vulnerability was addressed with
improved locking.
CVE-2026-28992: Johnny Franks (@zeroxjf)
IOHIDFamily
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to determine kernel memory layout
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28943: Google Threat Analysis Group
IOKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A maliciously crafted disk image may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-28954: Yiğit Can YILMAZ (@yilmazcanyigit)
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A buffer overflow was addressed with improved input
validation.
CVE-2026-28897: Robert Tran, popku1337, Billy Jheng Bing Jhong and Pan
Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Aswin kumar
Gokulakannan
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-28952: Calif.io in collaboration with Claude and Anthropic
Research
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to gain root privileges
Description: An authorization issue was addressed with improved state
management.
CVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with additional validation.
CVE-2026-28986: Tristan Madani (@TristanInSec) from Talence Security,
Ryan Hileman via Xint Code (xint.io), Chris Betz
Kernel
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to leak sensitive kernel state
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)
LaunchServices
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A remote attacker may be able to cause a denial of service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-28983: Ruslan Dautov
libxpc
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to enumerate a user's installed apps
Description: This issue was addressed with improved checks.
CVE-2026-28882: Ilya Andr (andrd3v), Ilias Morad (A2nkF) of Voynich
Group, Duy Trần (@khanhduytran0), @hugeBlack
Mail Drafts
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Replying to an email could display remote images in Mail in
Lockdown Mode
Description: A logic issue was addressed with improved checks.
CVE-2026-28929: Yiğit Can YILMAZ (@yilmazcanyigit)
mDNSResponder
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2026-43653: Atul R V
mDNSResponder
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43668: Ricardo Prado, Anton Pakhunov
mDNSResponder
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43666: Ian van der Wurff (ian.nl)
Model I/O
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
Model I/O
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing a maliciously crafted file may lead to a
denial-of-service or potentially disclose memory contents
Description: The issue was addressed with improved checks.
CVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
Networking
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An attacker may be able to track users through their IP address
Description: This issue was addressed through improved state management.
CVE-2026-28906: Ilya Sc. Jowell A.
Privacy
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to circumvent App Privacy Report logging
Description: This issue was addressed with additional entitlement
checks.
CVE-2026-28873: Guy Dor
Quick Look
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-43656: Peter Malone
SceneKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: A remote attacker may be able to cause unexpected app
termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28846: Peter Malone
Shortcuts
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed by adding an additional prompt for
user consent.
CVE-2026-28993: Doron Assness
Status Bar
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An app may be able to capture a user's screen
Description: An issue with app access to camera metadata was addressed
with improved logic.
CVE-2026-28957: Adriatik Raci
WebKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 308675
CVE-2026-28907: Cantina
WebKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: A validation issue was addressed with improved logic.
WebKit Bugzilla: 308906
CVE-2026-43660: Cantina
WebKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 308707
CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Daniel Rhea, Anonymous working
with TrendAI Zero Day Initiative
WebKit Bugzilla: 309601
CVE-2026-28904: Luka Rački
WebKit Bugzilla: 310303
CVE-2026-28903: Mateusz Krzywicki (iVerify.io)
WebKit Bugzilla: 310880
CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day
Initiative
WebKit Bugzilla: 309628
CVE-2026-28953: Maher Azzouzi
WebKit
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: Processing maliciously crafted web content may disclose
sensitive user information
Description: This issue was addressed with improved access restrictions.
WebKit Bugzilla: 309698
CVE-2026-28962: Vitaly Simonovich, Vaagn Vardanian, Luke Francis, kwak
kiyong / kakaogames,
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | APPLE-SA-05-11-2026-2 iOS |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0329 (this record)
- related CVE-2026-28819
- related CVE-2026-28846
- related CVE-2026-28847
- related CVE-2026-28870
- related CVE-2026-28872
- related CVE-2026-28873
- related CVE-2026-28877
- related CVE-2026-28882
- related CVE-2026-28894
- related CVE-2026-28897
- related CVE-2026-28903
- related CVE-2026-28904
- related CVE-2026-28906
- related CVE-2026-28907
- related CVE-2026-28917
- related CVE-2026-28920
- related CVE-2026-28929
- related CVE-2026-28936
- related CVE-2026-28940
- related CVE-2026-28941
- related CVE-2026-28943
- related CVE-2026-28951
- related CVE-2026-28952
- related CVE-2026-28953
- related CVE-2026-28954
- related CVE-2026-28955
- related CVE-2026-28957
- related CVE-2026-28959
- related CVE-2026-28962
- related CVE-2026-28969
- related CVE-2026-28972
- related CVE-2026-28977
- related CVE-2026-28983
- related CVE-2026-28986
- related CVE-2026-28987
- related CVE-2026-28992
- related CVE-2026-28993
- related CVE-2026-28994
- related CVE-2026-28995
- related CVE-2026-39869
- related CVE-2026-43653
- related CVE-2026-43654
- related CVE-2026-43656
- related CVE-2026-43659
- related CVE-2026-43660
- related CVE-2026-43666
- related CVE-2026-43668
{
"containers": {
"cna": {
"affected": [
{
"product": "APPLE-SA-05-11-2026-2 iOS",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-2 iOS 18.7.9 and iPadOS 18.7.9\n\niOS 18.7.9 and iPadOS 18.7.9 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127111.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccounts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28877: Rosyna Keller of Totally Not Malicious Software\n\nAPFS\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCalendar\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A resource exhaustion issue was addressed with improved\ninput validation.\nCVE-2026-28872: Alvin Aries Tapia\n\nCalling Framework\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A denial-of-service issue was addressed with improved input\nvalidation.\nCVE-2026-28894: an anonymous researcher\n\nCoreServices\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nFileProvider\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nGeoServices\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28870: XiguaSec\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nIOHIDFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-28954: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: Robert Tran, popku1337, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-28952: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to gain root privileges\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Tristan Madani (@TristanInSec) from Talence Security,\nRyan Hileman via Xint Code (xint.io), Chris Betz\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nlibxpc\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: This issue was addressed with improved checks.\nCVE-2026-28882: Ilya Andr (andrd3v), Ilias Morad (A2nkF) of Voynich\nGroup, Duy Tr\u1ea7n (@khanhduytran0), @hugeBlack\n\nMail Drafts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Replying to an email could display remote images in Mail in\nLockdown Mode\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-28929: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nmDNSResponder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43653: Atul R V\n\nmDNSResponder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Ricardo Prado, Anton Pakhunov\n\nmDNSResponder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nModel I/O\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service or potentially disclose memory contents\nDescription: The issue was addressed with improved checks.\nCVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetworking\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nPrivacy\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to circumvent App Privacy Report logging\nDescription: This issue was addressed with additional entitlement\nchecks.\nCVE-2026-28873: Guy Dor\n\nQuick Look\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-43656: Peter Malone\n\nSceneKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nStatus Bar\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to capture a user\u0027s screen\nDescription: An issue with app access to camera metadata was addressed\nwith improved logic.\nCVE-2026-28957: Adriatik Raci\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Daniel Rhea, Anonymous working\nwith TrendAI Zero Day Initiative\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: This issue was addressed with improved access restrictions.\nWebKit Bugzilla: 309698\nCVE-2026-28962: Vitaly Simonovich, Vaagn Vardanian, Luke Francis, kwak\nkiyong / kakaogames, "
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:55Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/6"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/6"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/en-us/127111"
},
{
"url": "https://www.apple.com/itunes/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/6"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-05-11-2026-2 iOS 18.7.9 and iPadOS 18.7.9",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28819",
"type": "related"
},
{
"destId": "CVE-2026-28846",
"type": "related"
},
{
"destId": "CVE-2026-28847",
"type": "related"
},
{
"destId": "CVE-2026-28870",
"type": "related"
},
{
"destId": "CVE-2026-28872",
"type": "related"
},
{
"destId": "CVE-2026-28873",
"type": "related"
},
{
"destId": "CVE-2026-28877",
"type": "related"
},
{
"destId": "CVE-2026-28882",
"type": "related"
},
{
"destId": "CVE-2026-28894",
"type": "related"
},
{
"destId": "CVE-2026-28897",
"type": "related"
},
{
"destId": "CVE-2026-28903",
"type": "related"
},
{
"destId": "CVE-2026-28904",
"type": "related"
},
{
"destId": "CVE-2026-28906",
"type": "related"
},
{
"destId": "CVE-2026-28907",
"type": "related"
},
{
"destId": "CVE-2026-28917",
"type": "related"
},
{
"destId": "CVE-2026-28920",
"type": "related"
},
{
"destId": "CVE-2026-28929",
"type": "related"
},
{
"destId": "CVE-2026-28936",
"type": "related"
},
{
"destId": "CVE-2026-28940",
"type": "related"
},
{
"destId": "CVE-2026-28941",
"type": "related"
},
{
"destId": "CVE-2026-28943",
"type": "related"
},
{
"destId": "CVE-2026-28951",
"type": "related"
},
{
"destId": "CVE-2026-28952",
"type": "related"
},
{
"destId": "CVE-2026-28953",
"type": "related"
},
{
"destId": "CVE-2026-28954",
"type": "related"
},
{
"destId": "CVE-2026-28955",
"type": "related"
},
{
"destId": "CVE-2026-28957",
"type": "related"
},
{
"destId": "CVE-2026-28959",
"type": "related"
},
{
"destId": "CVE-2026-28962",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-28972",
"type": "related"
},
{
"destId": "CVE-2026-28977",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-28986",
"type": "related"
},
{
"destId": "CVE-2026-28987",
"type": "related"
},
{
"destId": "CVE-2026-28992",
"type": "related"
},
{
"destId": "CVE-2026-28993",
"type": "related"
},
{
"destId": "CVE-2026-28994",
"type": "related"
},
{
"destId": "CVE-2026-28995",
"type": "related"
},
{
"destId": "CVE-2026-39869",
"type": "related"
},
{
"destId": "CVE-2026-43653",
"type": "related"
},
{
"destId": "CVE-2026-43654",
"type": "related"
},
{
"destId": "CVE-2026-43656",
"type": "related"
},
{
"destId": "CVE-2026-43659",
"type": "related"
},
{
"destId": "CVE-2026-43660",
"type": "related"
},
{
"destId": "CVE-2026-43666",
"type": "related"
},
{
"destId": "CVE-2026-43668",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0329",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/6",
"automated": true,
"contentSha256": "541a7a77b4b2fb689ad470f26d7cc327841ddd5e5c4e7bc7ecdca74c9114f54f",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/6",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-11T22:29:27Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0329"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:55Z",
"dateUpdated": "2026-09-11T07:55:55Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0329"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0333
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
VLAI
EPSS
VEX
Title
APPLE-SA-05-11-2026-6 macOS Tahoe 26.5
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-6 macOS Tahoe 26.5
macOS Tahoe 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127115.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available for: macOS Tahoe
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-28991: Seiji Sakurai (@HeapSmasher)
Accounts
Available for: macOS Tahoe
Impact: An app may be able to bypass certain Privacy preferences
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28988: Asaf Cohen
APFS
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28959: Dave G.
App Intents
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A logic issue was addressed with improved restrictions.
CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society
AppleJPEG
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may lead to a
denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-1837
AppleJPEG
Available for: macOS Tahoe
Impact: Processing a maliciously crafted media file may lead to
unexpected app termination or corrupt process memory
Description: A memory corruption issue was addressed with improved input
validation.
CVE-2026-28956: impost0r (ret2plt)
Audio
Available for: macOS Tahoe
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: The issue was addressed with improved memory handling.
CVE-2026-39869: David Ige of Beryllium Security
CoreMedia
Available for: macOS Tahoe
Impact: An app may be able to access private information
Description: This issue was addressed through improved state management.
CVE-2026-28922: Arni Hardarson
CoreServices
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved checks.
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CoreSymbolication
Available for: macOS Tahoe
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day
Initiative
CUPS
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: A parsing issue in the handling of directory paths was
addressed with improved path validation.
CVE-2026-28915: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
FileProvider
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-43659: Alex Radocea
GPU Drivers
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy)
HFS
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28925: Aswin Kumar Gokula Kannan, Dave G.
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: A buffer overflow issue was addressed with improved memory
handling.
CVE-2026-43661: an anonymous researcher
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-28977: Suresh Sundaram
ImageIO
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28990: Jiri Ha, Arni Hardarson
Installer
Available for: macOS Tahoe
Impact: A malicious app may be able to break out of its sandbox
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery
Engine
IOHIDFamily
Available for: macOS Tahoe
Impact: An attacker may be able to cause unexpected app termination
Description: A memory corruption vulnerability was addressed with
improved locking.
CVE-2026-28992: Johnny Franks (@zeroxjf)
IOHIDFamily
Available for: macOS Tahoe
Impact: An app may be able to determine kernel memory layout
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28943: Google Threat Analysis Group
IOKit
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar
IOSurfaceAccelerator
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43655: Somair Ansar and an anonymous researcher
Kernel
Available for: macOS Tahoe
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)
Kernel
Available for: macOS Tahoe
Impact: An app may be able to modify protected parts of the file system
Description: A denial of service issue was addressed by removing the
vulnerable code.
CVE-2026-28908: beist
Kernel
Available for: macOS Tahoe
Impact: A maliciously crafted disk image may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-28954: Yiğit Can YILMAZ (@yilmazcanyigit)
Kernel
Available for: macOS Tahoe
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A buffer overflow was addressed with improved input
validation.
CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar
Gokulakannan
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-28952: Calif.io in collaboration with Claude and Anthropic
Research
Kernel
Available for: macOS Tahoe
Impact: An app may be able to gain root privileges
Description: An authorization issue was addressed with improved state
management.
CVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with additional validation.
CVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence
Security, Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: macOS Tahoe
Impact: An app may be able to leak sensitive kernel state
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)
LaunchServices
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause a denial of service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-28983: Ruslan Dautov
Mail Drafts
Available for: macOS Tahoe
Impact: Replying to an email could display remote images in Mail in
Lockdown Mode
Description: A logic issue was addressed with improved checks.
CVE-2026-28929: Yiğit Can YILMAZ (@yilmazcanyigit)
mDNSResponder
Available for: macOS Tahoe
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2026-43653: Atul R V
mDNSResponder
Available for: macOS Tahoe
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-28985: Omar Cerrito
mDNSResponder
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43668: Anton Pakhunov, Ricardo Prado
mDNSResponder
Available for: macOS Tahoe
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43666: Ian van der Wurff (ian.nl)
Model I/O
Available for: macOS Tahoe
Impact: Processing a maliciously crafted file may lead to a
denial-of-service or potentially disclose memory contents
Description: The issue was addressed with improved checks.
CVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
Model I/O
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
Network Extensions
Available for: macOS Tahoe
Impact: An attacker with physical access to a locked device may be able
to view sensitive user information
Description: This issue was addressed with improved checks.
CVE-2026-28961: Dan Raviv
Networking
Available for: macOS Tahoe
Impact: An attacker may be able to track users through their IP address
Description: This issue was addressed through improved state management.
CVE-2026-28906: Ilya Sc. Jowell A.
Quick Look
Available for: macOS Tahoe
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-43656: Peter Malone
Sandbox
Available for: macOS Tahoe
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43652: Asaf Cohen
SceneKit
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-39870: Peter Malone
SceneKit
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected app
termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28846: Peter Malone
Shortcuts
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed by adding an additional prompt for
user consent.
CVE-2026-28993: Doron Assness
SMB
Available for: macOS Tahoe
Impact: A remote attacker may be able to cause unexpected system
termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28848: Peter Malone, Dave G. and Alex Radocea of Supernetworks
Spotlight
Available for: macOS Tahoe
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28930: Pan ZhenPeng (@P
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Macos Tahoe |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0333 (this record)
- related CVE-2026-1837
- related CVE-2026-28819
- related CVE-2026-28846
- related CVE-2026-28847
- related CVE-2026-28848
- related CVE-2026-28883
- related CVE-2026-28897
- related CVE-2026-28901
- related CVE-2026-28902
- related CVE-2026-28903
- related CVE-2026-28904
- related CVE-2026-28905
- related CVE-2026-28906
- related CVE-2026-28907
- related CVE-2026-28908
- related CVE-2026-28913
- related CVE-2026-28914
- related CVE-2026-28915
- related CVE-2026-28917
- related CVE-2026-28918
- related CVE-2026-28919
- related CVE-2026-28920
- related CVE-2026-28922
- related CVE-2026-28923
- related CVE-2026-28924
- related CVE-2026-28925
- related CVE-2026-28929
- related CVE-2026-28930
- related CVE-2026-28936
- related CVE-2026-28940
- related CVE-2026-28941
- related CVE-2026-28942
- related CVE-2026-28943
- related CVE-2026-28944
- related CVE-2026-28946
- related CVE-2026-28947
- related CVE-2026-28951
- related CVE-2026-28952
- related CVE-2026-28953
- related CVE-2026-28954
- related CVE-2026-28955
- related CVE-2026-28956
- related CVE-2026-28958
- related CVE-2026-28959
- related CVE-2026-28961
- related CVE-2026-28962
- related CVE-2026-28969
- related CVE-2026-28971
- related CVE-2026-28972
- related CVE-2026-28974
- related CVE-2026-28976
- related CVE-2026-28977
- related CVE-2026-28978
- related CVE-2026-28983
- related CVE-2026-28985
- related CVE-2026-28986
- related CVE-2026-28987
- related CVE-2026-28988
- related CVE-2026-28990
- related CVE-2026-28991
- related CVE-2026-28992
- related CVE-2026-28993
- related CVE-2026-28994
- related CVE-2026-28995
- related CVE-2026-28996
- related CVE-2026-39869
- related CVE-2026-39870
- related CVE-2026-39871
- related CVE-2026-43652
- related CVE-2026-43653
- related CVE-2026-43654
- related CVE-2026-43655
- related CVE-2026-43656
- related CVE-2026-43658
- related CVE-2026-43659
- related CVE-2026-43660
- related CVE-2026-43661
- related CVE-2026-43666
- related CVE-2026-43668
{
"containers": {
"cna": {
"affected": [
{
"product": "Macos Tahoe",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-6 macOS Tahoe 26.5\n\nmacOS Tahoe 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127115.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: macOS Tahoe\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: macOS Tahoe\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreMedia\nAvailable for: macOS Tahoe\nImpact: An app may be able to access private information\nDescription: This issue was addressed through improved state management.\nCVE-2026-28922: Arni Hardarson\n\nCoreServices\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreSymbolication\nAvailable for: macOS Tahoe\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nCUPS\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28915: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nFileProvider\nAvailable for: macOS Tahoe\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nGPU Drivers\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28923: Kun Peeks (@SwayZGl1tZyyy)\n\nHFS\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28925: Aswin Kumar Gokula Kannan, Dave G.\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nInstaller\nAvailable for: macOS Tahoe\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28978: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nIOHIDFamily\nAvailable for: macOS Tahoe\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: macOS Tahoe\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to modify protected parts of the file system\nDescription: A denial of service issue was addressed by removing the\nvulnerable code.\nCVE-2026-28908: beist\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A maliciously crafted disk image may bypass Gatekeeper checks\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-28954: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-28952: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to gain root privileges\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28951: Csaba Fitzl (@theevilbit) of Iru\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nMail Drafts\nAvailable for: macOS Tahoe\nImpact: Replying to an email could display remote images in Mail in\nLockdown Mode\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-28929: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43653: Atul R V\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28985: Omar Cerrito\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: macOS Tahoe\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted file may lead to a\ndenial-of-service or potentially disclose memory contents\nDescription: The issue was addressed with improved checks.\nCVE-2026-28941: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nModel I/O\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetwork Extensions\nAvailable for: macOS Tahoe\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: This issue was addressed with improved checks.\nCVE-2026-28961: Dan Raviv\n\nNetworking\nAvailable for: macOS Tahoe\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nQuick Look\nAvailable for: macOS Tahoe\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-43656: Peter Malone\n\nSandbox\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43652: Asaf Cohen\n\nSceneKit\nAvailable for: macOS Tahoe\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39870: Peter Malone\n\nSceneKit\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: macOS Tahoe\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nSMB\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28848: Peter Malone, Dave G. and Alex Radocea of Supernetworks\n\nSpotlight\nAvailable for: macOS Tahoe\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28930: Pan ZhenPeng (@P"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:28:19Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/11"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/11"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/downloads/"
},
{
"url": "https://support.apple.com/en-us/127115"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/11"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-05-11-2026-6 macOS Tahoe 26.5",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-1837",
"type": "related"
},
{
"destId": "CVE-2026-28819",
"type": "related"
},
{
"destId": "CVE-2026-28846",
"type": "related"
},
{
"destId": "CVE-2026-28847",
"type": "related"
},
{
"destId": "CVE-2026-28848",
"type": "related"
},
{
"destId": "CVE-2026-28883",
"type": "related"
},
{
"destId": "CVE-2026-28897",
"type": "related"
},
{
"destId": "CVE-2026-28901",
"type": "related"
},
{
"destId": "CVE-2026-28902",
"type": "related"
},
{
"destId": "CVE-2026-28903",
"type": "related"
},
{
"destId": "CVE-2026-28904",
"type": "related"
},
{
"destId": "CVE-2026-28905",
"type": "related"
},
{
"destId": "CVE-2026-28906",
"type": "related"
},
{
"destId": "CVE-2026-28907",
"type": "related"
},
{
"destId": "CVE-2026-28908",
"type": "related"
},
{
"destId": "CVE-2026-28913",
"type": "related"
},
{
"destId": "CVE-2026-28914",
"type": "related"
},
{
"destId": "CVE-2026-28915",
"type": "related"
},
{
"destId": "CVE-2026-28917",
"type": "related"
},
{
"destId": "CVE-2026-28918",
"type": "related"
},
{
"destId": "CVE-2026-28919",
"type": "related"
},
{
"destId": "CVE-2026-28920",
"type": "related"
},
{
"destId": "CVE-2026-28922",
"type": "related"
},
{
"destId": "CVE-2026-28923",
"type": "related"
},
{
"destId": "CVE-2026-28924",
"type": "related"
},
{
"destId": "CVE-2026-28925",
"type": "related"
},
{
"destId": "CVE-2026-28929",
"type": "related"
},
{
"destId": "CVE-2026-28930",
"type": "related"
},
{
"destId": "CVE-2026-28936",
"type": "related"
},
{
"destId": "CVE-2026-28940",
"type": "related"
},
{
"destId": "CVE-2026-28941",
"type": "related"
},
{
"destId": "CVE-2026-28942",
"type": "related"
},
{
"destId": "CVE-2026-28943",
"type": "related"
},
{
"destId": "CVE-2026-28944",
"type": "related"
},
{
"destId": "CVE-2026-28946",
"type": "related"
},
{
"destId": "CVE-2026-28947",
"type": "related"
},
{
"destId": "CVE-2026-28951",
"type": "related"
},
{
"destId": "CVE-2026-28952",
"type": "related"
},
{
"destId": "CVE-2026-28953",
"type": "related"
},
{
"destId": "CVE-2026-28954",
"type": "related"
},
{
"destId": "CVE-2026-28955",
"type": "related"
},
{
"destId": "CVE-2026-28956",
"type": "related"
},
{
"destId": "CVE-2026-28958",
"type": "related"
},
{
"destId": "CVE-2026-28959",
"type": "related"
},
{
"destId": "CVE-2026-28961",
"type": "related"
},
{
"destId": "CVE-2026-28962",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-28971",
"type": "related"
},
{
"destId": "CVE-2026-28972",
"type": "related"
},
{
"destId": "CVE-2026-28974",
"type": "related"
},
{
"destId": "CVE-2026-28976",
"type": "related"
},
{
"destId": "CVE-2026-28977",
"type": "related"
},
{
"destId": "CVE-2026-28978",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-28985",
"type": "related"
},
{
"destId": "CVE-2026-28986",
"type": "related"
},
{
"destId": "CVE-2026-28987",
"type": "related"
},
{
"destId": "CVE-2026-28988",
"type": "related"
},
{
"destId": "CVE-2026-28990",
"type": "related"
},
{
"destId": "CVE-2026-28991",
"type": "related"
},
{
"destId": "CVE-2026-28992",
"type": "related"
},
{
"destId": "CVE-2026-28993",
"type": "related"
},
{
"destId": "CVE-2026-28994",
"type": "related"
},
{
"destId": "CVE-2026-28995",
"type": "related"
},
{
"destId": "CVE-2026-28996",
"type": "related"
},
{
"destId": "CVE-2026-39869",
"type": "related"
},
{
"destId": "CVE-2026-39870",
"type": "related"
},
{
"destId": "CVE-2026-39871",
"type": "related"
},
{
"destId": "CVE-2026-43652",
"type": "related"
},
{
"destId": "CVE-2026-43653",
"type": "related"
},
{
"destId": "CVE-2026-43654",
"type": "related"
},
{
"destId": "CVE-2026-43655",
"type": "related"
},
{
"destId": "CVE-2026-43656",
"type": "related"
},
{
"destId": "CVE-2026-43658",
"type": "related"
},
{
"destId": "CVE-2026-43659",
"type": "related"
},
{
"destId": "CVE-2026-43660",
"type": "related"
},
{
"destId": "CVE-2026-43661",
"type": "related"
},
{
"destId": "CVE-2026-43666",
"type": "related"
},
{
"destId": "CVE-2026-43668",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0333",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/11",
"automated": true,
"contentSha256": "a2ec62f84ae6b32c6685ce18d20de1cbe8d4004a18fd7d143ac89e7ce011eb4b",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/11",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-11T22:32:57Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0333"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:55Z",
"dateUpdated": "2026-09-11T11:28:19Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0333"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0336
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
VLAI
EPSS
VEX
Title
APPLE-SA-05-11-2026-9 tvOS 26.5
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-9 tvOS 26.5
tvOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127118.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-28991: Seiji Sakurai (@HeapSmasher)
APFS
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28959: Dave G.
App Intents
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A malicious app may be able to break out of its sandbox
Description: A logic issue was addressed with improved restrictions.
CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society
AppleJPEG
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may lead to a
denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-1837
AppleJPEG
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted media file may lead to
unexpected app termination or corrupt process memory
Description: A memory corruption issue was addressed with improved input
validation.
CVE-2026-28956: impost0r (ret2plt)
Audio
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: The issue was addressed with improved memory handling.
CVE-2026-39869: David Ige of Beryllium Security
CoreSymbolication
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day
Initiative
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: A buffer overflow issue was addressed with improved memory
handling.
CVE-2026-43661: an anonymous researcher
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-28977: Suresh Sundaram
ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28990: Jiri Ha, Arni Hardarson
IOHIDFamily
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker may be able to cause unexpected app termination
Description: A memory corruption vulnerability was addressed with
improved locking.
CVE-2026-28992: Johnny Franks (@zeroxjf)
IOHIDFamily
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to determine kernel memory layout
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28943: Google Threat Analysis Group
IOKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar
IOSurfaceAccelerator
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43655: Somair Ansar and an anonymous researcher
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A buffer overflow was addressed with improved input
validation.
CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar
Gokulakannan
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with additional validation.
CVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence
Security, Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to leak sensitive kernel state
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)
LaunchServices
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote attacker may be able to cause a denial of service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-28983: Ruslan Dautov
mDNSResponder
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2026-43653: Atul R V
mDNSResponder
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-28985: Omar Cerrito
mDNSResponder
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43668: Anton Pakhunov, Ricardo Prado
mDNSResponder
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43666: Ian van der Wurff (ian.nl)
Model I/O
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
SceneKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote attacker may be able to cause unexpected app
termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28846: Peter Malone
Spotlight
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause a denial-of-service
Description: This issue was addressed with improved checks to prevent
unauthorized actions.
CVE-2026-28974: Andy Koo (@andykoo) of Hexens
Storage
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-28996: Alex Radocea
WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: A validation issue was addressed with improved logic.
WebKit Bugzilla: 308906
CVE-2026-43660: Cantina
WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 308675
CVE-2026-28907: Cantina
WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 307669
CVE-2026-43658: Do Young Park
WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 308545
CVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang
WebKit Bugzilla: 308707
CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI
Zero Day Initiative, Daniel Rhea
WebKit Bugzilla: 309601
CVE-2026-28904: Luka Rački
WebKit Bugzilla: 310880
CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day
Initiative
WebKit Bugzilla: 310303
CVE-2026-28903: Mateusz Krzywicki (iVerify.io)
WebKit Bugzilla: 309628
CVE-2026-28953: Maher Azzouzi
WebKit Bugzilla: 309861
CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,
Nathaniel Oh (@calysteon)
WebKit Bugzilla: 310207
CVE-2026-28901: Aisle offensive security research team (Joshua Rogers,
Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,
Ngan Nguyen of Calif.io
WebKit Bugzilla: 311631
CVE-2026-28913: an anonymous researcher
WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 313939
CVE-2026-28883: kwak kiyong / kakaogames
WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 310527
CVE-2026-28917: Vitaly Simonovich
WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 310234
CVE-2026-28947: dr3dd
WebKit Bugzilla: 312180
CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic
Wi-Fi
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker in a privileged network position may be able to
perform denial-of-service attack using crafted Wi-Fi packets
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28994: Alex Radocea
zlib
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Visiting a maliciously crafted website may leak sensitive data
Description: An information leakage was addressed with additional
validation.
CVE-2026-28920: Brendon Tiszka of Google Project Zero
Additional recognition
App Intents
We would like to acknowledge Mikael Kinnman for their assistance.
Apple Account
We would like to acknowledge Iván Savransky, YingQi Shi (@Mas0nShi) of
DBAppSecurity's WeBin lab for their assistance.
AuthKit
We would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.
CoreUI
We would like to acknowledge Mustafa Calap fo
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
reference
GCVE-1988-2026-0336 (this record)
- related CVE-2026-1837
- related CVE-2026-28846
- related CVE-2026-28847
- related CVE-2026-28883
- related CVE-2026-28897
- related CVE-2026-28901
- related CVE-2026-28902
- related CVE-2026-28903
- related CVE-2026-28904
- related CVE-2026-28905
- related CVE-2026-28907
- related CVE-2026-28913
- related CVE-2026-28917
- related CVE-2026-28918
- related CVE-2026-28920
- related CVE-2026-28940
- related CVE-2026-28942
- related CVE-2026-28943
- related CVE-2026-28947
- related CVE-2026-28953
- related CVE-2026-28955
- related CVE-2026-28956
- related CVE-2026-28959
- related CVE-2026-28969
- related CVE-2026-28972
- related CVE-2026-28974
- related CVE-2026-28977
- related CVE-2026-28983
- related CVE-2026-28985
- related CVE-2026-28986
- related CVE-2026-28987
- related CVE-2026-28990
- related CVE-2026-28991
- related CVE-2026-28992
- related CVE-2026-28994
- related CVE-2026-28995
- related CVE-2026-28996
- related CVE-2026-39869
- related CVE-2026-43653
- related CVE-2026-43654
- related CVE-2026-43655
- related CVE-2026-43658
- related CVE-2026-43660
- related CVE-2026-43661
- related CVE-2026-43666
- related CVE-2026-43668
{
"containers": {
"cna": {
"affected": [
{
"product": "Tvos",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-9 tvOS 26.5\n\ntvOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127118.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAPFS\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreSymbolication\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43653: Atul R V\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28985: Omar Cerrito\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nSceneKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nSpotlight\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStorage\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWi-Fi\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Wi-Fi packets\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28994: Alex Radocea\n\nzlib\nAvailable for: Apple TV HD and Apple TV 4K (all models)\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mikael Kinnman for their assistance.\n\nApple Account\nWe would like to acknowledge Iv\u00e1n Savransky, YingQi Shi (@Mas0nShi) of\nDBAppSecurity\u0027s WeBin lab for their assistance.\n\nAuthKit\nWe would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.\n\nCoreUI\nWe would like to acknowledge Mustafa Calap \u200b fo"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:28:28Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/13"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/13"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/en-us/127118"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/13"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-05-11-2026-9 tvOS 26.5",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-1837",
"type": "related"
},
{
"destId": "CVE-2026-28846",
"type": "related"
},
{
"destId": "CVE-2026-28847",
"type": "related"
},
{
"destId": "CVE-2026-28883",
"type": "related"
},
{
"destId": "CVE-2026-28897",
"type": "related"
},
{
"destId": "CVE-2026-28901",
"type": "related"
},
{
"destId": "CVE-2026-28902",
"type": "related"
},
{
"destId": "CVE-2026-28903",
"type": "related"
},
{
"destId": "CVE-2026-28904",
"type": "related"
},
{
"destId": "CVE-2026-28905",
"type": "related"
},
{
"destId": "CVE-2026-28907",
"type": "related"
},
{
"destId": "CVE-2026-28913",
"type": "related"
},
{
"destId": "CVE-2026-28917",
"type": "related"
},
{
"destId": "CVE-2026-28918",
"type": "related"
},
{
"destId": "CVE-2026-28920",
"type": "related"
},
{
"destId": "CVE-2026-28940",
"type": "related"
},
{
"destId": "CVE-2026-28942",
"type": "related"
},
{
"destId": "CVE-2026-28943",
"type": "related"
},
{
"destId": "CVE-2026-28947",
"type": "related"
},
{
"destId": "CVE-2026-28953",
"type": "related"
},
{
"destId": "CVE-2026-28955",
"type": "related"
},
{
"destId": "CVE-2026-28956",
"type": "related"
},
{
"destId": "CVE-2026-28959",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-28972",
"type": "related"
},
{
"destId": "CVE-2026-28974",
"type": "related"
},
{
"destId": "CVE-2026-28977",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-28985",
"type": "related"
},
{
"destId": "CVE-2026-28986",
"type": "related"
},
{
"destId": "CVE-2026-28987",
"type": "related"
},
{
"destId": "CVE-2026-28990",
"type": "related"
},
{
"destId": "CVE-2026-28991",
"type": "related"
},
{
"destId": "CVE-2026-28992",
"type": "related"
},
{
"destId": "CVE-2026-28994",
"type": "related"
},
{
"destId": "CVE-2026-28995",
"type": "related"
},
{
"destId": "CVE-2026-28996",
"type": "related"
},
{
"destId": "CVE-2026-39869",
"type": "related"
},
{
"destId": "CVE-2026-43653",
"type": "related"
},
{
"destId": "CVE-2026-43654",
"type": "related"
},
{
"destId": "CVE-2026-43655",
"type": "related"
},
{
"destId": "CVE-2026-43658",
"type": "related"
},
{
"destId": "CVE-2026-43660",
"type": "related"
},
{
"destId": "CVE-2026-43661",
"type": "related"
},
{
"destId": "CVE-2026-43666",
"type": "related"
},
{
"destId": "CVE-2026-43668",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0336",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/13",
"automated": true,
"contentSha256": "d2601279c96ad136c02829f670d7529562d8d9e35fc443c95372b638a08471bb",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/13",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-11T22:34:23Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0336"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:56Z",
"dateUpdated": "2026-09-11T11:28:28Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0336"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0337
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
VLAI
EPSS
VEX
Title
APPLE-SA-05-11-2026-10 watchOS 26.5
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-10 watchOS 26.5
watchOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127119.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available for: Apple Watch Series 6 and later
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-28991: Seiji Sakurai (@HeapSmasher)
Accounts
Available for: Apple Watch Series 6 and later
Impact: An app may be able to bypass certain Privacy preferences
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28988: Asaf Cohen
APFS
Available for: Apple Watch Series 6 and later
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28959: Dave G.
App Intents
Available for: Apple Watch Series 6 and later
Impact: A malicious app may be able to break out of its sandbox
Description: A logic issue was addressed with improved restrictions.
CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society
AppleJPEG
Available for: Apple Watch Series 6 and later
Impact: Processing a maliciously crafted image may lead to a
denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-1837
AppleJPEG
Available for: Apple Watch Series 6 and later
Impact: Processing a maliciously crafted media file may lead to
unexpected app termination or corrupt process memory
Description: A memory corruption issue was addressed with improved input
validation.
CVE-2026-28956: impost0r (ret2plt)
Audio
Available for: Apple Watch Series 6 and later
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: The issue was addressed with improved memory handling.
CVE-2026-39869: David Ige of Beryllium Security
CoreSymbolication
Available for: Apple Watch Series 6 and later
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day
Initiative
ImageIO
Available for: Apple Watch Series 6 and later
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: A buffer overflow issue was addressed with improved memory
handling.
CVE-2026-43661: an anonymous researcher
ImageIO
Available for: Apple Watch Series 6 and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-28977: Suresh Sundaram
ImageIO
Available for: Apple Watch Series 6 and later
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28990: Jiri Ha, Arni Hardarson
IOHIDFamily
Available for: Apple Watch Series 6 and later
Impact: An attacker may be able to cause unexpected app termination
Description: A memory corruption vulnerability was addressed with
improved locking.
CVE-2026-28992: Johnny Franks (@zeroxjf)
IOHIDFamily
Available for: Apple Watch Series 6 and later
Impact: An app may be able to determine kernel memory layout
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28943: Google Threat Analysis Group
IOKit
Available for: Apple Watch Series 6 and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar
IOSurfaceAccelerator
Available for: Apple Watch Series 6 and later
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-43655: Somair Ansar and an anonymous researcher
Kernel
Available for: Apple Watch Series 6 and later
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)
Kernel
Available for: Apple Watch Series 6 and later
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A buffer overflow was addressed with improved input
validation.
CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar
Gokulakannan
Kernel
Available for: Apple Watch Series 6 and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple Watch Series 6 and later
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with additional validation.
CVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence
Security, Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple Watch Series 6 and later
Impact: An app may be able to leak sensitive kernel state
Description: A logging issue was addressed with improved data redaction.
CVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)
LaunchServices
Available for: Apple Watch Series 6 and later
Impact: A remote attacker may be able to cause a denial of service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-28983: Ruslan Dautov
mDNSResponder
Available for: Apple Watch Series 6 and later
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43668: Anton Pakhunov, Ricardo Prado
mDNSResponder
Available for: Apple Watch Series 6 and later
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43666: Ian van der Wurff (ian.nl)
SceneKit
Available for: Apple Watch Series 6 and later
Impact: A remote attacker may be able to cause unexpected app
termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28846: Peter Malone
Spotlight
Available for: Apple Watch Series 6 and later
Impact: An app may be able to cause a denial-of-service
Description: This issue was addressed with improved checks to prevent
unauthorized actions.
CVE-2026-28974: Andy Koo (@andykoo) of Hexens
Storage
Available for: Apple Watch Series 6 and later
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-28996: Alex Radocea
WebKit
Available for: Apple Watch Series 6 and later
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: A validation issue was addressed with improved logic.
WebKit Bugzilla: 308906
CVE-2026-43660: Cantina
WebKit
Available for: Apple Watch Series 6 and later
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 308675
CVE-2026-28907: Cantina
WebKit
Available for: Apple Watch Series 6 and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 307669
CVE-2026-43658: Do Young Park
WebKit
Available for: Apple Watch Series 6 and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 313939
CVE-2026-28883: kwak kiyong / kakaogames
WebKit
Available for: Apple Watch Series 6 and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 308707
CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI
Zero Day Initiative, Daniel Rhea
WebKit Bugzilla: 309601
CVE-2026-28904: Luka Rački
WebKit Bugzilla: 310880
CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day
Initiative
WebKit Bugzilla: 310303
CVE-2026-28903: Mateusz Krzywicki (iVerify.io)
WebKit Bugzilla: 309628
CVE-2026-28953: Maher Azzouzi
WebKit Bugzilla: 309861
CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,
Nathaniel Oh (@calysteon)
WebKit Bugzilla: 310207
CVE-2026-28901: Aisle offensive security research team (Joshua Rogers,
Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,
Ngan Nguyen of Calif.io
WebKit Bugzilla: 311631
CVE-2026-28913: an anonymous researcher
WebKit
Available for: Apple Watch Series 6 and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 310527
CVE-2026-28917: Vitaly Simonovich
WebKit
Available for: Apple Watch Series 6 and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 310234
CVE-2026-28947: dr3dd
WebKit Bugzilla: 312180
CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic
Wi-Fi
Available for: Apple Watch Series 6 and later
Impact: An attacker in a privileged network position may be able to
perform denial-of-service attack using crafted Wi-Fi packets
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28994: Alex Radocea
zlib
Available for: Apple Watch Series 6 and later
Impact: Visiting a maliciously crafted website may leak sensitive data
Description: An information leakage was addressed with additional
validation.
CVE-2026-28920: Brendon Tiszka of Google Project Zero
Additional recognition
App Intents
We would like to acknowledge Mikael Kinnman for their assistance.
Apple Account
We would like to acknowledge Iván Savransky, YingQi Shi (@Mas0nShi) of
DBAppSecurity's WeBin lab for their assistance.
AuthKit
We would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.
CoreUI
We would like to acknowledge Mustafa Calap for their assistance.
ICU
We would like to acknowledge an anonymous researcher for their
assistance.
Kernel
We would like to acknowledge Ryan Hileman via Xint Code (xint.io),
Suresh Sundaram, an anonymous researcher for their assistance.
Libnotify
We would like to acknowledge Ilias Morad (@A2nkF_) for their assistance.
mDNSResponder
We would like to acknowledge Jason Grove for their assistance.
Messages
We would like to acknowledge Jeffery Kimbrow for their assistance.
Siri
We would like to acknowledge Yoav Magid for their assistance.
WebKit
We would like to acknowledge Vitaly Simonovich for their assistance.
Instructions on how to update your Apple Watch software are available at
https://support.apple.com/kb/HT204641
To check the version on your Apple Watch, open the Apple Watch app on
your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
All information is also posted on the Apple Security Releases
web site:
Severity
No CVSS data available.
Assigner
References
8 references
Relationships
reference
GCVE-1988-2026-0337 (this record)
- related CVE-2026-1837
- related CVE-2026-28846
- related CVE-2026-28847
- related CVE-2026-28883
- related CVE-2026-28897
- related CVE-2026-28901
- related CVE-2026-28902
- related CVE-2026-28903
- related CVE-2026-28904
- related CVE-2026-28907
- related CVE-2026-28913
- related CVE-2026-28917
- related CVE-2026-28918
- related CVE-2026-28920
- related CVE-2026-28942
- related CVE-2026-28943
- related CVE-2026-28947
- related CVE-2026-28953
- related CVE-2026-28955
- related CVE-2026-28956
- related CVE-2026-28959
- related CVE-2026-28969
- related CVE-2026-28972
- related CVE-2026-28974
- related CVE-2026-28977
- related CVE-2026-28983
- related CVE-2026-28986
- related CVE-2026-28987
- related CVE-2026-28988
- related CVE-2026-28990
- related CVE-2026-28991
- related CVE-2026-28992
- related CVE-2026-28994
- related CVE-2026-28995
- related CVE-2026-28996
- related CVE-2026-39869
- related CVE-2026-43654
- related CVE-2026-43655
- related CVE-2026-43658
- related CVE-2026-43660
- related CVE-2026-43661
- related CVE-2026-43666
- related CVE-2026-43668
{
"containers": {
"cna": {
"affected": [
{
"product": "Watchos",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-10 watchOS 26.5\n\nwatchOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127119.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple Watch Series 6 and later\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreSymbolication\nAvailable for: Apple Watch Series 6 and later\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nSceneKit\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nSpotlight\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStorage\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWi-Fi\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Wi-Fi packets\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28994: Alex Radocea\n\nzlib\nAvailable for: Apple Watch Series 6 and later\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mikael Kinnman for their assistance.\n\nApple Account\nWe would like to acknowledge Iv\u00e1n Savransky, YingQi Shi (@Mas0nShi) of\nDBAppSecurity\u0027s WeBin lab for their assistance.\n\nAuthKit\nWe would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.\n\nCoreUI\nWe would like to acknowledge Mustafa Calap \u200b for their assistance.\n\nICU\nWe would like to acknowledge an anonymous researcher for their\nassistance.\n\nKernel\nWe would like to acknowledge Ryan Hileman via Xint Code (xint.io),\nSuresh Sundaram, an anonymous researcher for their assistance.\n\nLibnotify\nWe would like to acknowledge Ilias Morad (@A2nkF_) for their assistance.\n\nmDNSResponder\nWe would like to acknowledge Jason Grove for their assistance.\n\nMessages\nWe would like to acknowledge Jeffery Kimbrow for their assistance.\n\nSiri\nWe would like to acknowledge Yoav Magid for their assistance.\n\nWebKit\nWe would like to acknowledge Vitaly Simonovich for their assistance.\n\nInstructions on how to update your Apple Watch software are available at\nhttps://support.apple.com/kb/HT204641\n\nTo check the version on your Apple Watch, open the Apple Watch app on\nyour iPhone and select \"My Watch \u003e General \u003e About\".\n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\".\n\nAll information is also posted on the Apple Security Releases\nweb site:"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:28:30Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/14"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/14"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/en-us/127119"
},
{
"url": "https://support.apple.com/kb/HT204641"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/14"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-05-11-2026-10 watchOS 26.5",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-1837",
"type": "related"
},
{
"destId": "CVE-2026-28846",
"type": "related"
},
{
"destId": "CVE-2026-28847",
"type": "related"
},
{
"destId": "CVE-2026-28883",
"type": "related"
},
{
"destId": "CVE-2026-28897",
"type": "related"
},
{
"destId": "CVE-2026-28901",
"type": "related"
},
{
"destId": "CVE-2026-28902",
"type": "related"
},
{
"destId": "CVE-2026-28903",
"type": "related"
},
{
"destId": "CVE-2026-28904",
"type": "related"
},
{
"destId": "CVE-2026-28907",
"type": "related"
},
{
"destId": "CVE-2026-28913",
"type": "related"
},
{
"destId": "CVE-2026-28917",
"type": "related"
},
{
"destId": "CVE-2026-28918",
"type": "related"
},
{
"destId": "CVE-2026-28920",
"type": "related"
},
{
"destId": "CVE-2026-28942",
"type": "related"
},
{
"destId": "CVE-2026-28943",
"type": "related"
},
{
"destId": "CVE-2026-28947",
"type": "related"
},
{
"destId": "CVE-2026-28953",
"type": "related"
},
{
"destId": "CVE-2026-28955",
"type": "related"
},
{
"destId": "CVE-2026-28956",
"type": "related"
},
{
"destId": "CVE-2026-28959",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-28972",
"type": "related"
},
{
"destId": "CVE-2026-28974",
"type": "related"
},
{
"destId": "CVE-2026-28977",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-28986",
"type": "related"
},
{
"destId": "CVE-2026-28987",
"type": "related"
},
{
"destId": "CVE-2026-28988",
"type": "related"
},
{
"destId": "CVE-2026-28990",
"type": "related"
},
{
"destId": "CVE-2026-28991",
"type": "related"
},
{
"destId": "CVE-2026-28992",
"type": "related"
},
{
"destId": "CVE-2026-28994",
"type": "related"
},
{
"destId": "CVE-2026-28995",
"type": "related"
},
{
"destId": "CVE-2026-28996",
"type": "related"
},
{
"destId": "CVE-2026-39869",
"type": "related"
},
{
"destId": "CVE-2026-43654",
"type": "related"
},
{
"destId": "CVE-2026-43655",
"type": "related"
},
{
"destId": "CVE-2026-43658",
"type": "related"
},
{
"destId": "CVE-2026-43660",
"type": "related"
},
{
"destId": "CVE-2026-43661",
"type": "related"
},
{
"destId": "CVE-2026-43666",
"type": "related"
},
{
"destId": "CVE-2026-43668",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0337",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/14",
"automated": true,
"contentSha256": "3baf5add0c01cc8ee054262d9daab2f941583d12a67f5a92738590246114b1c1",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/14",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-11T22:34:46Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0337"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:56Z",
"dateUpdated": "2026-09-11T11:28:30Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0337"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0338
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
VLAI
EPSS
VEX
Title
APPLE-SA-05-11-2026-11 visionOS 26.5
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-11 visionOS 26.5
visionOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127120.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-28991: Seiji Sakurai (@HeapSmasher)
Accounts
Available for: Apple Vision Pro (all models)
Impact: An app may be able to bypass certain Privacy preferences
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-28988: Asaf Cohen
APFS
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28959: Dave G.
App Intents
Available for: Apple Vision Pro (all models)
Impact: A malicious app may be able to break out of its sandbox
Description: A logic issue was addressed with improved restrictions.
CVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society
AppleJPEG
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to a
denial-of-service
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2026-1837
AppleJPEG
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted media file may lead to
unexpected app termination or corrupt process memory
Description: A memory corruption issue was addressed with improved input
validation.
CVE-2026-28956: impost0r (ret2plt)
Audio
Available for: Apple Vision Pro (all models)
Impact: Processing an audio stream in a maliciously crafted media file
may terminate the process
Description: The issue was addressed with improved memory handling.
CVE-2026-39869: David Ige of Beryllium Security
CoreAnimation
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2026-28964: Alan Wang, Christopher W. Fletcher, Hovav Shacham, David
Kohlbrenner, Riccardo Paccagnella
CoreServices
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved checks.
CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
CoreSymbolication
Available for: Apple Vision Pro (all models)
Impact: Parsing a maliciously crafted file may lead to an unexpected app
termination
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day
Initiative
FileProvider
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-43659: Alex Radocea
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-28977: Suresh Sundaram
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28990: Jiri Ha, Arni Hardarson
IOHIDFamily
Available for: Apple Vision Pro (all models)
Impact: An attacker may be able to cause unexpected app termination
Description: A memory corruption vulnerability was addressed with
improved locking.
CVE-2026-28992: Johnny Franks (@zeroxjf)
IOKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar
Kernel
Available for: Apple Vision Pro (all models)
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)
Kernel
Available for: Apple Vision Pro (all models)
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A buffer overflow was addressed with improved input
validation.
CVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar
Gokulakannan
Kernel
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
LaunchServices
Available for: Apple Vision Pro (all models)
Impact: A remote attacker may be able to cause a denial of service
Description: A type confusion issue was addressed with improved checks.
CVE-2026-28983: Ruslan Dautov
mDNSResponder
Available for: Apple Vision Pro (all models)
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-43668: Anton Pakhunov, Ricardo Prado
mDNSResponder
Available for: Apple Vision Pro (all models)
Impact: An attacker on the local network may be able to cause a
denial-of-service
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-43666: Ian van der Wurff (ian.nl)
Model I/O
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: The issue was addressed with improved memory handling.
CVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day
Initiative
Networking
Available for: Apple Vision Pro (all models)
Impact: An attacker may be able to track users through their IP address
Description: This issue was addressed through improved state management.
CVE-2026-28906: Ilya Sc. Jowell A.
SceneKit
Available for: Apple Vision Pro (all models)
Impact: A remote attacker may be able to cause unexpected app
termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-28846: Peter Malone
Shortcuts
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed by adding an additional prompt for
user consent.
CVE-2026-28993: Doron Assness
Spotlight
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause a denial-of-service
Description: This issue was addressed with improved checks to prevent
unauthorized actions.
CVE-2026-28974: Andy Koo (@andykoo) of Hexens
Status Bar
Available for: Apple Vision Pro (all models)
Impact: An app may be able to capture a user's screen
Description: An issue with app access to camera metadata was addressed
with improved logic.
CVE-2026-28957: Adriatik Raci
Storage
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-28996: Alex Radocea
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: A validation issue was addressed with improved logic.
WebKit Bugzilla: 308906
CVE-2026-43660: Cantina
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 308675
CVE-2026-28907: Cantina
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may disclose
sensitive user information
Description: This issue was addressed with improved access restrictions.
WebKit Bugzilla: 309698
CVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,
Vitaly Simonovich, Adel Bouachraoui, greenbynox
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 307669
CVE-2026-43658: Do Young Park
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 308545
CVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang
WebKit Bugzilla: 308707
CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI
Zero Day Initiative, Daniel Rhea
WebKit Bugzilla: 309601
CVE-2026-28904: Luka Rački
WebKit Bugzilla: 310880
CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day
Initiative
WebKit Bugzilla: 310303
CVE-2026-28903: Mateusz Krzywicki (iVerify.io)
WebKit Bugzilla: 309628
CVE-2026-28953: Maher Azzouzi
WebKit Bugzilla: 309861
CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,
Nathaniel Oh (@calysteon)
WebKit Bugzilla: 310207
CVE-2026-28901: Aisle offensive security research team (Joshua Rogers,
Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,
Ngan Nguyen of Calif.io
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 313939
CVE-2026-28883: kwak kiyong / kakaogames
WebKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
WebKit Bugzilla: 311228
CVE-2026-28958: Cantina
WebKit
Available for: Apple Vision Pro (all models)
Impact: A malicious iframe may use another website’s download settings
Description: The issue was addressed with improved UI handling.
WebKit Bugzilla: 311288
CVE-2026-28971: Khiem Tran
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 312180
CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic
WebKit Bugzilla: 310234
CVE-2026-28947: dr3dd
WebKit
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 310527
CVE-2026-28917: Vitaly Simonovich
WebRTC
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 311131
CVE-2026-28944: Kenneth Hsu of Palo Alto Networks, Jérôme DJOUDER, dr3dd
zlib
Available for: Apple Vision Pro (all models)
Impact: Visiting a maliciously crafted website may leak sensitive data
Description: An information leakage was addressed with additional
validation.
CVE-2026-28920: Brendon Tiszka of Google Project Zero
Additional recognition
App Intents
We would like to acknowledge Mi
Severity
No CVSS data available.
Assigner
References
8 references
Relationships
reference
GCVE-1988-2026-0338 (this record)
- related CVE-2026-1837
- related CVE-2026-28846
- related CVE-2026-28847
- related CVE-2026-28883
- related CVE-2026-28897
- related CVE-2026-28901
- related CVE-2026-28902
- related CVE-2026-28903
- related CVE-2026-28904
- related CVE-2026-28905
- related CVE-2026-28906
- related CVE-2026-28907
- related CVE-2026-28917
- related CVE-2026-28918
- related CVE-2026-28920
- related CVE-2026-28936
- related CVE-2026-28940
- related CVE-2026-28942
- related CVE-2026-28944
- related CVE-2026-28947
- related CVE-2026-28953
- related CVE-2026-28955
- related CVE-2026-28956
- related CVE-2026-28957
- related CVE-2026-28958
- related CVE-2026-28959
- related CVE-2026-28962
- related CVE-2026-28964
- related CVE-2026-28969
- related CVE-2026-28971
- related CVE-2026-28972
- related CVE-2026-28974
- related CVE-2026-28977
- related CVE-2026-28983
- related CVE-2026-28988
- related CVE-2026-28990
- related CVE-2026-28991
- related CVE-2026-28992
- related CVE-2026-28993
- related CVE-2026-28995
- related CVE-2026-28996
- related CVE-2026-39869
- related CVE-2026-43654
- related CVE-2026-43658
- related CVE-2026-43659
- related CVE-2026-43660
- related CVE-2026-43666
- related CVE-2026-43668
{
"containers": {
"cna": {
"affected": [
{
"product": "Visionos",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-11 visionOS 26.5\n\nvisionOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127120.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreAnimation\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-28964: Alan Wang, Christopher W. Fletcher, Hovav Shacham, David\nKohlbrenner, Riccardo Paccagnella\n\nCoreServices\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreSymbolication\nAvailable for: Apple Vision Pro (all models)\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nFileProvider\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nLaunchServices\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetworking\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nSceneKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nSpotlight\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStatus Bar\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to capture a user\u0027s screen\nDescription: An issue with app access to camera metadata was addressed\nwith improved logic.\nCVE-2026-28957: Adriatik Raci\n\nStorage\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: This issue was addressed with improved access restrictions.\nWebKit Bugzilla: 309698\nCVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,\nVitaly Simonovich, Adel Bouachraoui, greenbynox\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nWebKit Bugzilla: 311228\nCVE-2026-28958: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious iframe may use another website\u2019s download settings\nDescription: The issue was addressed with improved UI handling.\nWebKit Bugzilla: 311288\nCVE-2026-28971: Khiem Tran\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebRTC\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 311131\nCVE-2026-28944: Kenneth Hsu of Palo Alto Networks, J\u00e9r\u00f4me DJOUDER, dr3dd\n\nzlib\nAvailable for: Apple Vision Pro (all models)\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mi"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:28:31Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/15"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/en-us/127120"
},
{
"url": "https://support.apple.com/kb/HT214009"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/15"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-05-11-2026-11 visionOS 26.5",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-1837",
"type": "related"
},
{
"destId": "CVE-2026-28846",
"type": "related"
},
{
"destId": "CVE-2026-28847",
"type": "related"
},
{
"destId": "CVE-2026-28883",
"type": "related"
},
{
"destId": "CVE-2026-28897",
"type": "related"
},
{
"destId": "CVE-2026-28901",
"type": "related"
},
{
"destId": "CVE-2026-28902",
"type": "related"
},
{
"destId": "CVE-2026-28903",
"type": "related"
},
{
"destId": "CVE-2026-28904",
"type": "related"
},
{
"destId": "CVE-2026-28905",
"type": "related"
},
{
"destId": "CVE-2026-28906",
"type": "related"
},
{
"destId": "CVE-2026-28907",
"type": "related"
},
{
"destId": "CVE-2026-28917",
"type": "related"
},
{
"destId": "CVE-2026-28918",
"type": "related"
},
{
"destId": "CVE-2026-28920",
"type": "related"
},
{
"destId": "CVE-2026-28936",
"type": "related"
},
{
"destId": "CVE-2026-28940",
"type": "related"
},
{
"destId": "CVE-2026-28942",
"type": "related"
},
{
"destId": "CVE-2026-28944",
"type": "related"
},
{
"destId": "CVE-2026-28947",
"type": "related"
},
{
"destId": "CVE-2026-28953",
"type": "related"
},
{
"destId": "CVE-2026-28955",
"type": "related"
},
{
"destId": "CVE-2026-28956",
"type": "related"
},
{
"destId": "CVE-2026-28957",
"type": "related"
},
{
"destId": "CVE-2026-28958",
"type": "related"
},
{
"destId": "CVE-2026-28959",
"type": "related"
},
{
"destId": "CVE-2026-28962",
"type": "related"
},
{
"destId": "CVE-2026-28964",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-28971",
"type": "related"
},
{
"destId": "CVE-2026-28972",
"type": "related"
},
{
"destId": "CVE-2026-28974",
"type": "related"
},
{
"destId": "CVE-2026-28977",
"type": "related"
},
{
"destId": "CVE-2026-28983",
"type": "related"
},
{
"destId": "CVE-2026-28988",
"type": "related"
},
{
"destId": "CVE-2026-28990",
"type": "related"
},
{
"destId": "CVE-2026-28991",
"type": "related"
},
{
"destId": "CVE-2026-28992",
"type": "related"
},
{
"destId": "CVE-2026-28993",
"type": "related"
},
{
"destId": "CVE-2026-28995",
"type": "related"
},
{
"destId": "CVE-2026-28996",
"type": "related"
},
{
"destId": "CVE-2026-39869",
"type": "related"
},
{
"destId": "CVE-2026-43654",
"type": "related"
},
{
"destId": "CVE-2026-43658",
"type": "related"
},
{
"destId": "CVE-2026-43659",
"type": "related"
},
{
"destId": "CVE-2026-43660",
"type": "related"
},
{
"destId": "CVE-2026-43666",
"type": "related"
},
{
"destId": "CVE-2026-43668",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0338",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/15",
"automated": true,
"contentSha256": "d41d3eeafa51fab79df0402daf905e08347a3f2461a9cade5a868886101bbfb8",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-11T22:35:21Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0338"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:56Z",
"dateUpdated": "2026-09-11T11:28:31Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0338"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0367
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:28
VLAI
EPSS
VEX
Title
APPLE-SA-05-13-2026-1 Safari 26.5
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-13-2026-1 Safari 26.5
Safari 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127121.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: A validation issue was addressed with improved logic.
WebKit Bugzilla: 308906
CVE-2026-43660: Cantina
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 308675
CVE-2026-28907: Cantina
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may disclose
sensitive user information
Description: This issue was addressed with improved access restrictions.
WebKit Bugzilla: 309698
CVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,
Vitaly Simonovich, Adel Bouachraoui, greenbynox
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 307669
CVE-2026-43658: Do Young Park
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 308545
CVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang
WebKit Bugzilla: 308707
CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI
Zero Day Initiative, Daniel Rhea
WebKit Bugzilla: 309601
CVE-2026-28904: Luka Rački
WebKit Bugzilla: 310880
CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day
Initiative
WebKit Bugzilla: 310303
CVE-2026-28903: Mateusz Krzywicki (iVerify.io)
WebKit Bugzilla: 309628
CVE-2026-28953: Maher Azzouzi
WebKit Bugzilla: 309861
CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,
Nathaniel Oh (@calysteon)
WebKit Bugzilla: 310207
CVE-2026-28901: Aisle offensive security research team (Joshua Rogers,
Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,
Ngan Nguyen of Calif.io
WebKit Bugzilla: 311631
CVE-2026-28913: an anonymous researcher
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 313939
CVE-2026-28883: kwak kiyong / kakaogames
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
WebKit Bugzilla: 311228
CVE-2026-28958: Cantina
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved input validation.
WebKit Bugzilla: 310527
CVE-2026-28917: Vitaly Simonovich
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 310234
CVE-2026-28947: dr3dd
WebKit Bugzilla: 310544
CVE-2026-28946: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox
WebKit Bugzilla: 312180
CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: A malicious iframe may use another website’s download settings
Description: The issue was addressed with improved UI handling.
CVE-2026-28971: Khiem Tran
WebKit Bugzilla: 311288
WebRTC
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 311131
CVE-2026-28944: Kenneth Hsu of Palo Alto Networks, Jérôme DJOUDER, dr3dd
Additional recognition
Safari
We would like to acknowledge sean mutuku for their assistance.
Safari Push Notifications
We would like to acknowledge Robert Mindo for their assistance.
WebKit
We would like to acknowledge Muhammad Zaid Ghifari (Mr.ZheeV),
Kalimantan Utara, Qadhafy Muhammad Tera, Vitaly Simonovich for their
assistance.
WebRTC
We would like to acknowledge Hyeonji Son (@jir4vv1t) of Demon Team for
their assistance.
Safari 26.5 may be obtained from the Mac App Store.
All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoE52oACgkQ4Ifiq8DH
7PV9tw/8C759AP/3NbUY9aGa7CjwMsAcI+/Y3Gt1NpNpOiTqBO9fVzFR5rzkPELk
TGhNZ8fbGOMZji8i7tizeEbHzdZXaaVAvmBdFlhx8mmBtOMi1f8vFUQh+FeWiMDn
1BhlLMF2VigV8FcoyFiYIkcfaNYFnd3/QpDzQ4M0W7Wb/+xztzvqkgcTxQrhsNkN
WfxUkSzsZlcv6XOb/P9KqAr66Y1NRhVNeYFuEd3rcJYnL6nap4p0HlwgGmyU1Grs
PW0hOBmWo2HSFWOxOQ2akMtkOqpCiSjcI3FPwlMAagyhjieaZXT5/HrfCs0SelI2
kJVGpDiySNYxtKPbHYvDwjhVBRv2NaX6LFaNqVm20CaaFQGdF5sRGgTBJC7LtfCs
1PKnLcv2ov+isEYPEUsWjIWemFEi8nO+p9NkpqY6rMoOWbGKsi2IELbC5QNjgKVA
8/LEsQXW2Qf0RKQqlWk35Zv7ZWD2+ezjP/jNHYHvZJAN0IHR7HZOqfCm+V8uGndx
8iQDQ3R38mcsIUOYIMjuVP1PfVnMqyFSAVFkE/qtyTUk5TqsO4vdsQ/MKoxNXoW+
lHZT2q7ijQBGSteuax6XhH2r7hGxAXMols59EaJM3LZecDiqvOUloPC40hCItxEL
0VO4Cjuoz0UR2n4oafNs+AldAyuNnhlWEpYhgKbzkuySObOQ6TE=
=5v8r
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
reference
GCVE-1988-2026-0367 (this record)
- related CVE-2026-28847
- related CVE-2026-28883
- related CVE-2026-28901
- related CVE-2026-28902
- related CVE-2026-28903
- related CVE-2026-28904
- related CVE-2026-28905
- related CVE-2026-28907
- related CVE-2026-28913
- related CVE-2026-28917
- related CVE-2026-28942
- related CVE-2026-28944
- related CVE-2026-28946
- related CVE-2026-28947
- related CVE-2026-28953
- related CVE-2026-28955
- related CVE-2026-28958
- related CVE-2026-28962
- related CVE-2026-28971
- related CVE-2026-43658
- related CVE-2026-43660
{
"containers": {
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-13-2026-1 Safari 26.5\n\nSafari 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127121.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: This issue was addressed with improved access restrictions.\nWebKit Bugzilla: 309698\nCVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,\nVitaly Simonovich, Adel Bouachraoui, greenbynox\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nWebKit Bugzilla: 311228\nCVE-2026-28958: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 310544\nCVE-2026-28946: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious iframe may use another website\u2019s download settings\nDescription: The issue was addressed with improved UI handling.\nCVE-2026-28971: Khiem Tran\nWebKit Bugzilla: 311288\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 311131\nCVE-2026-28944: Kenneth Hsu of Palo Alto Networks, J\u00e9r\u00f4me DJOUDER, dr3dd\n\nAdditional recognition\n\nSafari\nWe would like to acknowledge sean mutuku for their assistance.\n\nSafari Push Notifications\nWe would like to acknowledge Robert Mindo for their assistance.\n\nWebKit\nWe would like to acknowledge Muhammad Zaid Ghifari (Mr.ZheeV),\nKalimantan Utara, Qadhafy Muhammad Tera, Vitaly Simonovich for their\nassistance.\n\nWebRTC\nWe would like to acknowledge Hyeonji Son (@jir4vv1t) of Demon Team for\ntheir assistance.\n\nSafari 26.5 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoE52oACgkQ4Ifiq8DH\n7PV9tw/8C759AP/3NbUY9aGa7CjwMsAcI+/Y3Gt1NpNpOiTqBO9fVzFR5rzkPELk\nTGhNZ8fbGOMZji8i7tizeEbHzdZXaaVAvmBdFlhx8mmBtOMi1f8vFUQh+FeWiMDn\n1BhlLMF2VigV8FcoyFiYIkcfaNYFnd3/QpDzQ4M0W7Wb/+xztzvqkgcTxQrhsNkN\nWfxUkSzsZlcv6XOb/P9KqAr66Y1NRhVNeYFuEd3rcJYnL6nap4p0HlwgGmyU1Grs\nPW0hOBmWo2HSFWOxOQ2akMtkOqpCiSjcI3FPwlMAagyhjieaZXT5/HrfCs0SelI2\nkJVGpDiySNYxtKPbHYvDwjhVBRv2NaX6LFaNqVm20CaaFQGdF5sRGgTBJC7LtfCs\n1PKnLcv2ov+isEYPEUsWjIWemFEi8nO+p9NkpqY6rMoOWbGKsi2IELbC5QNjgKVA\n8/LEsQXW2Qf0RKQqlWk35Zv7ZWD2+ezjP/jNHYHvZJAN0IHR7HZOqfCm+V8uGndx\n8iQDQ3R38mcsIUOYIMjuVP1PfVnMqyFSAVFkE/qtyTUk5TqsO4vdsQ/MKoxNXoW+\nlHZT2q7ijQBGSteuax6XhH2r7hGxAXMols59EaJM3LZecDiqvOUloPC40hCItxEL\n0VO4Cjuoz0UR2n4oafNs+AldAyuNnhlWEpYhgKbzkuySObOQ6TE=\n=5v8r\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:28:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/16"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/16"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/en-us/127121"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/16"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-05-13-2026-1 Safari 26.5",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28847",
"type": "related"
},
{
"destId": "CVE-2026-28883",
"type": "related"
},
{
"destId": "CVE-2026-28901",
"type": "related"
},
{
"destId": "CVE-2026-28902",
"type": "related"
},
{
"destId": "CVE-2026-28903",
"type": "related"
},
{
"destId": "CVE-2026-28904",
"type": "related"
},
{
"destId": "CVE-2026-28905",
"type": "related"
},
{
"destId": "CVE-2026-28907",
"type": "related"
},
{
"destId": "CVE-2026-28913",
"type": "related"
},
{
"destId": "CVE-2026-28917",
"type": "related"
},
{
"destId": "CVE-2026-28942",
"type": "related"
},
{
"destId": "CVE-2026-28944",
"type": "related"
},
{
"destId": "CVE-2026-28946",
"type": "related"
},
{
"destId": "CVE-2026-28947",
"type": "related"
},
{
"destId": "CVE-2026-28953",
"type": "related"
},
{
"destId": "CVE-2026-28955",
"type": "related"
},
{
"destId": "CVE-2026-28958",
"type": "related"
},
{
"destId": "CVE-2026-28962",
"type": "related"
},
{
"destId": "CVE-2026-28971",
"type": "related"
},
{
"destId": "CVE-2026-43658",
"type": "related"
},
{
"destId": "CVE-2026-43660",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0367",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/16",
"automated": true,
"contentSha256": "284818841648cbd52b15b9b3cc23c072a07f159b9afa1bd6427c0b564951697f",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/16",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-13T21:39:47Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0367"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:58Z",
"dateUpdated": "2026-09-11T11:28:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0367"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…