CVE-2026-28917

The vulnerability arises from improper input validation (CWE‑20) that permits maliciously crafted web content to trigger an unexpected process crash when processed by Safari, iOS, iPadOS, macOS, tvOS, visionOS, or watchOS. The crash interrupts normal operation and results in a denial of service; it does not enable code execution or compromise data confidentiality.

Affected devices include Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The fix is delivered in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

The CVSS score of 4.3, EPSS score of <1%, and the absence from CISA's KEV list indicate a moderate severity and low exploitation probability. The issue requires processing of maliciously crafted web content, which suggests the attack vector involves either local exposure of such content or remote delivery through web services on the device. While the vulnerability does not provide code execution, it can cause repeated crashes, creating a significant availability risk especially for services relying on uninterrupted web content processing. Since exploitation requires the presence of malformed content, the likelihood of attack remains moderate but the impact on affected systems is high for denial of service scenarios.