CVE-2026-28953 - Vulnerability Details

Description

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Published: 2026-05-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a memory handling error that causes an unexpected crash of the affected process when maliciously crafted web content is processed, delivering a denial‑of‑service condition. The weakness is an improper handling of memory resources, classified as CWE‑119.

Affected Systems

Apple systems affected include iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The bug exists in versions prior to the fixes applied in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

Risk and Exploitability

The CVSS score is 7.5, indicating a medium severity. The EPSS score is < 1 %, suggesting a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The documented trigger is the delivery of malicious web content, which represents the primary attack vector. No active exploitation has been reported as of the latest advisory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.9
`0`	affected	< 26.5

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

95%

Version	Status	Scheme	Platform
`[0,18.7.9)`	affected	semver	—
`[0,26.5)`	affected	generic	—

Apple

Macos

95%

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Tvos

95%

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Visionos

95%

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Watchos

95%

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to an iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5 or later to apply the memory‑handling fix.
Limit or block the loading of untrusted web content by configuring device content‑security policies or disabling automatic redirects that may surface the flaw.
Continuously monitor Apple security advisories and apply any subsequent patches or mitigations promptly.

Generated by OpenCVE AI on May 12, 2026 at 16:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00033.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/127110
https://support.apple.com/en-us/127111
https://support.apple.com/en-us/127115
https://support.apple.com/en-us/127118
https://support.apple.com/en-us/127119
https://support.apple.com/en-us/127120

History

Tue, 12 May 2026 17:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple ipados Apple iphone Os

Tue, 12 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Title	Malicious Web Content Crash Causes Denial of Service

Tue, 12 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 11 May 2026 23:00:00 +0000

Type	Values Removed	Values Added
Title		Malicious Web Content Crash Causes Denial of Service
Weaknesses		CWE-119

Mon, 11 May 2026 22:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos

Mon, 11 May 2026 20:45:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
References		https://support.apple.com/en-us/127110 https://support.apple.com/en-us/127111 https://support.apple.com/en-us/127115 https://support.apple.com/en-us/127118 https://support.apple.com/en-us/127119 https://support.apple.com/en-us/127120

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Tvos Visionos Watchos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-05-11T20:07:52.634Z

Updated: 2026-05-12T13:15:29.904Z

Reserved: 2026-03-03T16:36:03.990Z

Link: CVE-2026-28953

Vulnrichment

Updated: 2026-05-12T13:15:18.914Z

NVD

Status : Analyzed

Published: 2026-05-11T21:18:56.367

Modified: 2026-05-12T17:22:59.310

Link: CVE-2026-28953

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-05-12T16:15:19Z

Weaknesses

CWE-119

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object