CVE-2026-28985

View on CVE.org
Published May 11, 2026 CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Description
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5. An attacker on the local network may be able to cause a denial-of-service.

Analysis

AI-generated

Technical impact

A null pointer dereference occurs due to insufficient input validation in several Apple operating systems. When triggered, the system can crash, resulting in a loss of availability for the affected device. This flaw is classified as CWE‑476, indicating an improper null dereference vulnerability. The impact is limited to denial of service rather than confidentiality or integrity compromise.

Affected Systems

Apple iOS, iPadOS, macOS (Tahoe), and tvOS devices running versions prior to 26.5 are affected. The vulnerability is fixed in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and tvOS 26.5. Attackers who can send crafted input from the local network to the vulnerable component may trigger the denial of service.

Risk and Exploitability

The CVSS score is 6.2, and the EPSS score is <1%, though the vulnerability is not listed in the CISA KEV catalog. Attackers must be on the same local network to send the malicious payload from the local network to the vulnerable component may trigger the denial of service.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update all affected devices to iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, or tvOS 26.5 as soon as updates are available.
  • If an immediate update is not possible, use network controls (such as firewall or packet filtering) to block or monitor suspicious traffic from local network sources that could trigger the vulnerability.
  • Continuously monitor system logs for abnormal crashes or restarts that may indicate exploitation attempts, and investigate any occurrences promptly.

Generated by OpenCVE AI on May 12, 2026 at 21:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Type Values Removed Values Added
Title Local Network Man‑In‑The‑Middle Attack Can Trigger Denial of Service via Null Pointer Dereference in Apple Operating Systems
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple tvos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple tvos
Type Values Removed Values Added
Title Local Network Man‑In‑The‑Middle Attack Can Trigger Denial of Service via Null Pointer Dereference in Apple Operating Systems
Weaknesses CWE-476
Type Values Removed Values Added
Description A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5. An attacker on the local network may be able to cause a denial-of-service.
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
May 12, 2026, 5:26 PM
Reserved
Mar 3, 2026, 4:36 PM

View source JSON

Updated
May 12, 2026, 5:26 PM

JSON

Status
Analyzed
Published
May 11, 2026, 9:18 PM
Modified
Oct 26, 2026, 6:10 PM

View source JSON

No data.

Updated
May 12, 2026, 9:30 PM

JSON