CVE-2026-28968

CVE-2026-28968 is an out-of-bounds write caused by insufficient bounds checking in Apple's platform software, addressed with improved checks in the broad September 2026 round of OS updates. A malicious or compromised app running on an affected device can trigger the flaw, resulting in unexpected system termination or corruption of kernel memory — an impact that typically signals crash/DoS potential and, in the worst case, a path toward privilege escalation or sandbox escape on Apple platforms. All unpatched iPhones and iPads (before iOS/iPadOS 26.7), Macs (macOS Sequoia before 15.8 and macOS Tahoe before 26.7), and Apple TV, Apple Watch, and Vision Pro devices on pre-27 builds of tvOS, watchOS, and visionOS are affected. Exploitation is local and app-triggered, so an attacker would first need to deliver a malicious app (for example via sideloading, abused enterprise certificates, or App Store review evasion) rather than attack remotely over the network. No public proof-of-concept exists, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported as of the advisory.

What to do: Deploy the September 2026 Apple updates as soon as possible: iOS/iPadOS 26.7 (or 27), macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. In managed fleets, use MDM to enforce minimum OS versions and audit patch compliance across all device types, since the fix shipped across every Apple platform simultaneously. Because the flaw is triggered by a locally running app, restrict sideloading and untrusted enterprise-signed or developer-signed apps on high-value devices to shrink the attack surface.