Description
The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote attacker may cause an unexpected app termination.
Published: 2026-03-25
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A remote attacker can trigger an unexpected termination of applications running on Apple iOS or iPadOS. The issue was addressed with improved checks in later releases, implying that a flaw in resource handling caused the crash. The vulnerability is mapped to CWE‑400, which indicates an unchecked resource exhaustion condition; this connection is inferred from the CWE reference rather than directly stated in the description.

Affected Systems

Devices operating on Apple iOS or iPadOS versions earlier than 26.4 are affected. The flaw can cause any application running on those earlier operating systems to terminate unexpectedly, potentially disrupting user workflows and dependent services.

Risk and Exploitability

The CVSS score of 7.5 classifies the vulnerability as high severity, yet the EPSS score is reported as under 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the description explicitly states that a remote attacker may cause the crash, the attack vector is remote, and the impact is limited to application availability rather than broader system compromise.

Generated by OpenCVE AI on March 26, 2026 at 22:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest iOS 26.4 or iPadOS 26.4 update
  • Verify the successful installation of the update on all target devices
  • Monitor system logs for any remaining crash events
  • Consult Apple support documents for any additional guidance

Generated by OpenCVE AI on March 26, 2026 at 22:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://support.apple.com/en-us/126792 cve-icon cve-icon
History

Fri, 27 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
Title Remote App Termination in Apple iOS/iPadOS

Thu, 26 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Thu, 26 Mar 2026 12:30:00 +0000

Type Values Removed Values Added
Title Remote Attacker Can Trigger Application Crash in iOS/iPadOS
Weaknesses CWE-476
CWE-703

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title Remote Attacker Can Trigger Application Crash in iOS/iPadOS
Weaknesses CWE-476
CWE-703

Wed, 25 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Vendors & Products Apple
Apple ios And Ipados

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote attacker may cause an unexpected app termination.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:20:40.614Z

Reserved: 2026-03-03T16:36:03.974Z

Link: CVE-2026-28874

cve-icon Vulnrichment

Updated: 2026-03-25T19:46:40.365Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T01:17:11.210

Modified: 2026-03-26T20:12:08.337

Link: CVE-2026-28874

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-27T09:50:36Z

Weaknesses