Description
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service.
Published: 2026-05-11
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A type confusion vulnerability exists in multiple Apple operating systems where the system may interpret data as a different type. This flaw, identified as CWE‑843, can be triggered by a remote attacker who sends specially crafted input. When the vulnerability is exploited, the operating system may crash, resulting in a denial of service on the affected device.

Affected Systems

Apple environments impacted by this issue include iOS and iPadOS on iPhone and iPad, macOS Sequoia, macOS Sonoma, macOS Tahoe, tvOS, visionOS, and watchOS. The fix is included in iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Devices running any prior releases remain vulnerable until these updates are installed.

Risk and Exploitability

The CVSS score of 7.5 reflects a moderate severity of potential disruption. The EPSS score of < 1% indicates a very low probability of real‑world exploitation, and the vulnerability currently does not appear in CISA’s KEV catalog, suggesting no known active exploits. Based on the EPSS score and KEV status, the overall likelihood of exploitation is low, but a remote attacker could still cause service interruption if the device is running a vulnerable OS version.

Generated by OpenCVE AI on August 3, 2026 at 07:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device to the latest supported Apple OS version, such as iOS 18.7.9 or 26.5, iPadOS 18.7.9 or 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5.
  • Enable automatic system updates to ensure future patches are applied without manual intervention.
  • If the device cannot run the patched OS releases, consider hardware replacement or migrating to an alternative platform that supports recent security patches.

Generated by OpenCVE AI on August 3, 2026 at 07:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Title Type Confusion-Induced Denial of Service in Apple Operating Systems

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service. A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service.
References

Wed, 13 May 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Tue, 12 May 2026 22:15:00 +0000

Type Values Removed Values Added
Title Apple Operating System Type Confusion Vulnerability Enabling Remote Denial of Service
Weaknesses CWE-745

Tue, 12 May 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-843

Tue, 12 May 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 11 May 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos
Apple watchos

Mon, 11 May 2026 23:00:00 +0000

Type Values Removed Values Added
Title Apple Operating System Type Confusion Vulnerability Enabling Remote Denial of Service
Weaknesses CWE-745

Mon, 11 May 2026 20:45:00 +0000

Type Values Removed Values Added
Description A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-07-27T20:14:54.633Z

Reserved: 2026-03-03T16:36:03.993Z

Link: CVE-2026-28983

cve-icon Vulnrichment

Updated: 2026-05-12T17:51:44.895Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-11T21:18:58.423

Modified: 2026-06-17T10:29:26.650

Link: CVE-2026-28983

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T08:00:04Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')