CVE-2026-28940
published 2026-05-11CVE-2026-28940: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7…
PriorityP347high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.60%
44.5th percentile
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing a maliciously crafted image may corrupt process memory.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 18.7.9 | 18.7.9 |
| apple | ios_and_ipados | < 26.5 | 26.5 |
| apple | ipados | < 18.7.9 | 18.7.9 |
| apple | ipados | >= 26.0 < 26.5 | 26.5 |
| apple | iphone_os | < 18.7.9 | 18.7.9 |
| apple | iphone_os | >= 26.0 < 26.5 | 26.5 |
| apple | macos | < 15.7.7 | 15.7.7 |
| apple | macos | < 26.5 | 26.5 |
| apple | macos | >= 15.0 < 15.7.7 | 15.7.7 |
| apple | macos | >= 26.0 < 26.5 | 26.5 |
| apple | tvos | < 26.5 | 26.5 |
| apple | visionos | < 26.5 | 26.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iOS/iPadOS/macOS/tvOS/visionOS up to 18.7.8/26.4 Image memory corruption
vuldb·2026-05-23·CVSS 7.5
CVE-2026-28940 [HIGH] Apple iOS/iPadOS/macOS/tvOS/visionOS up to 18.7.8/26.4 Image memory corruption
A vulnerability has been found in Apple iOS, iPadOS, macOS, tvOS and visionOS up to 18.7.8/26.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Image Handler. The manipulation leads to memory corruption.
This vulnerability is listed as CVE-2026-28940. The attack may be initiated remotely. There is no available exploit.
The affected component should be upgraded.
GHSA
GHSA-757x-6rpx-jpwf: The issue was addressed with improved memory handling
ghsa_unreviewed·2026-05-11
CVE-2026-28940 [HIGH] CWE-119 GHSA-757x-6rpx-jpwf: The issue was addressed with improved memory handling
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing a maliciously crafted image may corrupt process memory.
No detection rules found.
No public exploits indexed.
2026-05-11
Published