CVE-2026-28995

EUVD-2026-29288
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
Affected Products (NVD)
VendorProductVersion
appleipados
𝑥
< 18.7.9
appleipados
26.0 ≤
𝑥
< 26.5
appleiphone_os
𝑥
< 18.7.9
appleiphone_os
26.0 ≤
𝑥
< 26.5
applemacos
26.0 ≤
𝑥
< 26.5
appletvos
𝑥
< 26.5
applevisionos
𝑥
< 26.5
applewatchos
𝑥
< 26.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://support.apple.com/en-us/127110
https://support.apple.com/en-us/127111
https://support.apple.com/en-us/127115
https://support.apple.com/en-us/127118
https://support.apple.com/en-us/127119
https://support.apple.com/en-us/127120