AI analysis
CVE-2026-28966 is an out-of-bounds write flaw caused by insufficient bounds checking in Apple's operating systems, patched across iOS/iPadOS, macOS, tvOS, and visionOS. It is triggered when a device processes a maliciously crafted file, meaning an attacker needs to deliver a booby-trapped file to the target (e.g., via a message, download, or web content). Apple's stated impact is unexpected app termination (a denial-of-service condition), though out-of-bounds writes are a memory-corruption class that can potentially be escalated to arbitrary code execution depending on the affected component. All users on iOS/iPadOS prior to 26.7 or 27, macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, macOS Golden Gate prior to 27, tvOS prior to 27, and visionOS prior to 27 are affected. No CVSS score has been assigned, the flaw is not on the CISA KEV list, and no public proof-of-concept or in-the-wild exploitation is known.
What to do: Update all Apple devices promptly: iPhone/iPad to iOS/iPadOS 26.7 or 27, Macs to macOS Sequoia 15.8, Tahoe 26.7, or Golden Gate 27, Apple TV to tvOS 27, and Vision Pro to visionOS 27 (Settings > General > Software Update). Enable automatic updates and use MDM to force patch deployment across managed fleets. Treat unsolicited files, attachments, and media from untrusted sources with caution until patched, since the flaw is triggered by processing a maliciously crafted file.
Affected
| Apple iOS | fixed in iOS 26.7 and iOS 27; prior versions affected |
| Apple iPadOS | fixed in iPadOS 26.7 and iPadOS 27; prior versions affected |
| Apple macOS Sequoia | fixed in macOS Sequoia 15.8; prior versions affected |
| Apple macOS Tahoe | fixed in macOS Tahoe 26.7; prior versions affected |
| Apple macOS Golden Gate | fixed in macOS Golden Gate 27; prior versions affected |
| Apple tvOS | fixed in tvOS 27; prior versions affected |
| Apple visionOS | fixed in visionOS 27; prior versions affected |
Estimated exposure
mass≈1B+ devices (essentially the entire Apple iPhone, iPad, Mac, Apple TV, and Vision Pro installed base not yet patched) — Apple has publicly reported an active installed base of over 2 billion devices, and this flaw spans every major Apple platform, so the patch-pending population plausibly exceeds 1 billion devices following a typical patch-adoption curve.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted file may lead to unexpected app termination.