CVE-2026-28918: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5…

PriorityP431medium6.5CVSS 3.1

AVNACLPRNUIRSUCNINAH

EPSS

0.49%

38.7th percentile

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
apple	ios_and_ipados	< 26.5	26.5
apple	ipados	< 26.5	26.5
apple	iphone_os	< 26.5	26.5
apple	macos	< 26.5	26.5
apple	macos	>= 26.0 < 26.5	26.5
apple	tvos	< 26.5	26.5
apple	visionos	< 26.5	26.5
apple	watchos	< 26.5	26.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.