CVE-2026-28864: Use After Free

Published Mar 24, 2026
·
Updated

802.1X. An authentication issue was addressed with improved state management.

Other sources

Accelerate Framework. An out-of-bounds write issue was addressed with improved bounds checking.

— Apple

Accelerate. An out-of-bounds read was addressed with improved bounds checking.

— Apple

AccessorySetupKit. An authentication issue was addressed with improved state management.

— Apple

Accounts. A logging issue was addressed with improved data redaction.

— Apple

Accounts. A path handling issue was addressed with improved validation.

— Apple

Credit

Justin Cohen(Google), Cristian Dinca (icmd.tech), Hossein Lotfi@@hosselot(TrendAI Zero Day Initiative), Etienne Charron (Renault), Victoria Martini (Renault), Zhongcheng Li(IES Red Team), CVE-2025-14524, Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), Kirin@@Pwnrin, CVE-2025-64505, iG0x72(XiguaSec), JJ(XiguaSec), Lehan Dilusha Jayasinghe, Gor Aleksanyan(BoB 0xB6), Dhiyanesh Selvaraj@@redroot97(BoB 0xB6), 이동하 (Lee Dong Ha(BoB 0xB6), Jian Lee@@speedyfriend433, Johnny Franks@@0xjohnny, Alex Radocea, Hazem Issa, Yongdae Kim @ SysSec, KAIST, Caspian Tarafdar, Andrew Becker, webb, Thomas Espach, Mike Cardwell(grepular), Bob Lord, Hongze Wu(Ant Group Infrastructure Security Team), Shuaike Dong(Ant Group Infrastructure Security Team), @@hamayanhamayan, Johnny Franks (zeroxjf), an anonymous researcher, Héloïse Gollier, Mathy Vanhoef (KU Leuven), wdszzml, Atuin Automated Vulnerability Discovery Engine, Christian Kohlschütter, Sreejith Krishnan R, Dave G., @@pixiepointsec, Mickey Jin@@patch1t, Luke Roberts@@rookuu, Pedro Tôrres@@t0rr3sp3dr0, Yeonghyeon Choi, Daniel Rhea, Söhnke Benedikt Fischedick (Tripton), Emrovsky & Switch3301, Yevhen Pervushyn, Minse Kim, Narcis Oliveras Fontàs, Nathaniel Oh@@calysteon, greenbynox, Arni Hardarson, Gongyu Ma@@Mezone0, XiguaSec, DARKNAVY@@DarkNavyOrg, Ilya Andr (andrd3v)(RTU MIREA), Ilias Morad (A2nkF)(Voynich Group), Duy Trần@@khanhduytran0, @@hugeBlack, Himanshu Bharti@@Xpl0itme(Khatima), Guy Dor, Jex Amro, Tuan D. Hoang, Yongdae Kim @ KAIST SysSec Lab, Alvin Aries Tapia, Rosyna Keller(Totally Not Malicious Software), Adrián Pérez Martínez, Uluk Abylbekov, Zack Tickman, Dalibor Milanovic, Rahul Raj, Hcamael, 章鱼哥 (aipyaipy.com)@@aipy, lunar815, Piotr Jerzy Duszynski, Surej Sekhar, r3pwnx@@r3pwnx, Lily Cohl@@GenericCoding, Marco Schmitt(Calif), Andrey Chernykh(Calif), Josh Maine(Calif), Franco Belman at Blackwing Intelligence, Chris Bailey - Short Circuit, Neon, Niels Hofmans, Mustafa Calap@@ordinal0, dbg.re), N.M.Praveen Nawarathne@@zblockrat, Tucker Willenborg, Jihwan Yoon, Meta Red Team X - Nik Tsytsarkin, Altin Gashi, Përparim Mjeku, Meta Product Security, f4&Zhiniang Peng with HUST(Calif), Aobo Wang@@M4x_1997(Calif), Xiang Chen(Calif), Jakob Pammer(Calif), Anna Groza@@pwnlambda(Calif), Adriatik Raci(Lupus Nova), Chris Bailey - Short Circuit(Lupus Nova), Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), Nurihan Kim (HanTul)(TrendAI Zero Day Initiative), R4mbb, He Wei (ギカク), Yash Pandya, Parth Raval, ธนกฤต ทัฬหะ(Google Project Zero), Mateusz Jurczyk(Google Project Zero), f0r(MurphySec), PETOWORKS의 Bugeun Choi@@Bugeun, an anonymous researcher(Google Project Zero), Nik Tsytsarkin, Eddy Tsalolikhin, Johann Rehberger, sh3rlock (김보겸), Wout van der Ploeg (woutvanderploeg.nl), XlabAI Team(Tencent Xuanwu Lab), Guannan Wang, Zhanpeng Liu, Jiashuo Liang, Guancheng Li, Musaab Khan@@bxff, Iain Harkiss, Daniel Febrero, Charles Stevenson, Mathis Mansière, Seung Je Seong, Bhuwan Bhetwal(Braze Security Team), Kwak Kiyong@@Pwnkai23(Braze Security Team), Song Nuri(Braze Security Team), Nicolas Seriot(Braze Security Team), Tommy DeVoss@@thedawgyg(Braze Security Team), Navapon Premkasem, Aswin Kumar Gokulakannan, Peter Malone, Richard Zana, Pedro Pinho, Wang Yu, OpenAI(STAR Labs SG Pte), Billy Jheng Bing Jhong(STAR Labs SG Pte), Pan Zhenpeng@@Peterpan0927(STAR Labs SG Pte), Arnold Cartagena(Tolmo), Matt Suiche@@msuiche(Tolmo), Xinru Chi(Pangu Lab), Tim Michaud@@TimGMichaud(Aginor), Nebula Security@@nebusecurity, CVE-2019-5598, Pasquale Scola, Cem Onat Karagun, John Lussier, Marc Newlin(SkySafe), Will Estes, Jerry L. Knot, Eliya M., Viacheslav Radiukov, Tristan Madani (Talence Security), Robert Tran, Vinay Kumar Rasala (Xplo8E)(Appknox), Daniel Rodríguez, Sindre Sorhus, Abodi Dawoud(Lupus Nova), Ilya Andr (andrd3v)(Positive Technologies), Zhongquan Li@@Guluisacat, Asaf Cohen, Mahmoud Abdelmoniem, Zhongcheng Li (CK01), 진규정 (Gyujeong Jin(DEVCORE Research Team), @@G1uN4sh(DEVCORE Research Team), Lucas Parnell(DEVCORE Research Team), Nathaniel Oh@@calysteon(DEVCORE Research Team), Meta Red Team X - Nik Tsytsarkin(DEVCORE Research Team), YingMuo@@YingMuo(DEVCORE Research Team), ret2happy@@ret2happy, Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan), Varik Matevosyan@@D4RK7ET, Prafull Dhiman, Alto_00000, Hongsik Kim (mnur), stratan@@5tratan, 정우 하@@0xfa11babe, Narendra Singh@@_3P1C, Yujung Choi@@Dusker, Stav Nir, Vladimir Tokarev, Arni Hardarson (Neonix Security)(Iru), Csaba Fitzl@@theevilbit(Iru), Gergely Kalman@@gergely_kalman, Aditya Kumar, Lucas Lammer, Stuart Wallace, Jagannath Mohanty, Santiago Albertengo, @@Licht_jb, Mohamad Dawoud, Rotce(SkySafe), Sandeep Wawdane (thecybersandeep)(SkySafe), Ankur Saini(Volexity), Kwak Kiyong@@Pwnkai23, Song nuri, Luke Francis@@lukefr09, MYUNGYONG LEE, Shubham Chaskar, Do Young Park (adawn), Kwak Kiyong, Song Nuri, OpenAI Codex Security - Amy Burnett, 은태 장, Euntae Jang, pwn2addr, Franz Bettag, Myungyong Lee, Gia Bui@@yabeow(Calif), Chris Rohlf with Anthropic Research, Josef Korbel (Citadelo), Malik M.@@m411k_, Charles Kern, Drinor Selmanaj (Sentry), Bhaswanth Chigurupati, Daniel, KennethLi, Jaebin Sim (simjabin.com)@@gmail, Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Johan Wahyudi, Dohyeon An Technology Inc@@PILAB, Seiji Sakurai@@HeapSmasher, We Muftihaturrahmah, Aswin Kumar Gokula Kannan, Ruslan Dautov, Thomas Guillem, Thanatos Tian (HKPolyU) & wgg with Diffract, tamdao, Jaeyeong Lee, Chanwit Muenprakoddee (ChemIndy), Paul Montgomery@@nullevent, Lakshay Sharma (MrW0r57), Abodi Dawoud, Murray Mike(Nosebeard Labs), 준우 이, zenith, Frederick Kaludis (Coiffeur0x90)(Nosebeard Labs), DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, Zwei Tasse Kaffee, an anonymous researcher(Calif), 章鱼哥 (aipyaipy.com)@@aipy(Calif), Roman Zabicki(Calif), Jurre van Bergen - Threatnotify, 章鱼哥 (aipyaipy.com）@@aipy, Redon Gashi (Sentry), Sanny Mitra, Alfredo Pesoli@@__rev(Bynar), Koh M. Nakagawa@@tsunek0h(FFRI Security Inc), Lyutoon, Andrey Chernykh (BypassLabs.ai), Keisuke Hosoda, oxsignal, f00l@@PPPF00L, 3ndy1@@_3ndy1, Anand (anandsreekumar.com), powerprove(Protectiv IT Security Inc), Michael Benich(Protectiv IT Security Inc), Niels Hofmans(Protectiv IT Security Inc), Christian Niel Angel(Protectiv IT Security Inc), Lyutoon(SecuRing), Seung Je Seong(SecuRing), R4mbb(SecuRing), Wojciech Regula(SecuRing), Minseok Kim, Thanatos Tian (HKPolyU) & wgg & xmr, Marco Schmitt, Sattyam Yadav(Protectiv IT Security Inc), onetwo(Protectiv IT Security Inc), Merrick Hare, Andrey Chernykh, Sihyun Roh (Compsec, SNU), Frederick Kaludis (Coiffeur0x90)(DBAppSecurity's WeBin lab), YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Lakshay Sharma (MrW0r57)/WorstCase Labs.(Iru), Ashish Kavishwar(Iru), Nebula Security@@nebusecurity(Aginor), Jakob Pammer, Mustafa Ahmed, Saoud Khalifah, Jonathan Bar Or@@yo_yo_yo_jbo, Siddharth Aeri, Gabriel '0xv1n' Cardona, Mrunal Chawda, Kujtim Kryeziu (Sentry), 도현 김, Ithrael, YEONGJAE SHIN, Efstratios Kaplanellis@@5tratan(Almamater Technologies), ruitong@@abstract, an anonymous researcher(Nosebeard Labs), Niels Hofmans(Nosebeard Labs), 도현 김(Nosebeard Labs), Junyeong Lee (jylab.github.io)(Nosebeard Labs), Jonghoon Han (Aegis), Ahmad Al Harrizuan Izadin(Iru), Prathamesh Walunj(Iru), f4&Zhiniang Peng with HUST, Geonha Lee@@leegn4a, Substrate, Arni Hardarson (Neonix Security), Stefan Esser (Calif), Alfredo Pesoli via Bynario Atlas (bynar.io)@@__rev, Anon Tuttu Venus, koocolb, Pranav Gopalkrishnan, Alan Wang, Ailsa Sun, Hovav Shacham, Riccardo Paccagnella, Chris Fletcher, David Kohlbrenner, Richard Hyunho Im at Route Zero Security@@richeeta(Almamater Technologies), cnitlrt@@abstract(Sentry), Roman Belovitskiy(Sentry), Lyutoon(Sentry), Art Pllana(Sentry), Redon Gashi(Sentry), lokerxx, Teodor Sorescu@@teodorsorescu, Phillip Groves, cnitlrt@@abstract, 진규정 (Gyujeong Jin, @@G1uN4sh, Albin Haliti, Morris Richman@@morrisinlife, Bhuwan Bhetwal(ThreatBook), Feng Xue(ThreatBook), XGPT(ThreatBook), Nathaniel Oh@@calysteon(Talence Security), Narendra Singh@@_3P1C(Talence Security), Tristan Madani@@TristanInSec(Talence Security), D4rthL, Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Gergely Kalman@@gergely_kalman(Nosebeard Labs), Lyutoon(Nosebeard Labs), Jaeyeong Lee(Nosebeard Labs), Maher Azzouzi, Frederick Kaludis (Coiffeur0x90), Mufeed VH(Winfunc Research), 云开 江, Joshua Maina, Mahmoud Gamal@@Zombiehelp54, Thanatos Tian (HKPolyU) & wgg & 2st with Diffract(Aginor), Peter Malone(Aginor), David Krehwinkel, Ricardo Prado, Ryan Dowd@@_rdowd, CVE-2025-55753, CVE-2025-58098, CVE-2025-59775, CVE-2025-65082, CVE-2025-66200, Talal Haj Bakry(Mysk Inc), Tommy Mysk@@mysk_co(Mysk Inc), 风沐云烟@@binary_fmyy, Minghao Lin@@Y1nKoc, Ye Zhang(Baidu Security), Ryan Dowd@@_rdowd(Iru), Joseph Ravichandran@@0xjprx(MIT CSAIL), hari shanmugam, Yuebin Sun@@yuebinsun2020(SecuRing), an anonymous researcher(SecuRing), Nathaniel Oh@@calysteon(SecuRing), Kirin@@Pwnrin(SecuRing), Joshua Jewett@@JoshJewett33, Rodolphe Brunetti@@eisw0lf(Lupus Nova), Matej Moravec@@MacejkoMoravec, Dawuge(Shuffle Team), Hunan University, Andrei Dodu, Kun Peeks@@SwayZGl1tZyyy, Gyujeong Jin at Team.0xb6@@G1uN4sh, Nguyen Duc Anh(Noventiq), Bhuwan Bhetwal, Kwak kiyong@@Pwnkai23, Lance Cain - Senior Security Researcher at SpecterOps Inc., Murray Mike, Ye Zhang@@VAR10CK(Baidu Security), Rahul Raj(Google Project Zero), Piotr Jerzy Duszynski(Google Project Zero), PETOWORKS의 Bugeun Choi@@Bugeun(Google Project Zero), Nord0x, Ryan Hileman via Xint Code (xint.io), Yiğit Can YILMAZ@@yilmazcanyigit, Guilherme Rambo(Best Buddy Apps), Amy (amys.website), @@cloudlldb, Chunyu Song(NorthSea)

Affected Software

22 affected componentsFixes available
Apple iPadOS<18.7.7
Apple iPadOS>=26.0<26.4
Apple iPhone OS<18.7.7
Apple iPhone OS>=26.0<26.4
Apple macOS>=14.0<14.8.5
Apple macOS>=15.0<15.7.5
Apple macOS>=26.0<26.4
Apple visionOS<26.4
Apple WatchOS<26.4
Apple iOS<18.7.7
18.7.7
Apple iPadOS<18.7.7
18.7.7
Apple macOS Tahoe<26.4
26.4
Apple iOS<26.4
26.4
Apple iPadOS<26.4
26.4
Apple macOS Sequoia<15.7.5
15.7.5
Apple macOS Sonoma<14.8.5
14.8.5
Apple WatchOS<26.4
26.4
Apple visionOS<26.4
26.4
Apple iOS<26.7.2
26.7.2
Apple iPadOS<26.7.2
26.7.2
Apple macOS Tahoe<26.7.2
26.7.2
Apple macOS Sequoia<15.8.2
15.8.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 18.7.7
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 26.4
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.7.5
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 14.8.5
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 26.7.2
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.8.2
  7. Upgrade

    Upgrade Apple iOS/iPadOS to a version that resolves this vulnerability.

    Fixed in 18.7.7
  8. Upgrade

    Upgrade Apple iOS/iPadOS to a version that resolves this vulnerability.

    Fixed in 26.4
  9. Upgrade

    Upgrade Apple iOS/iPadOS to a version that resolves this vulnerability.

    Fixed in 26.7.2
  10. Upgrade

    Upgrade Apple macOS Sequoia to a version that resolves this vulnerability.

    Fixed in 15.7.5
  11. Upgrade

    Upgrade Apple macOS Sequoia to a version that resolves this vulnerability.

    Fixed in 15.8.2
  12. Upgrade

    Upgrade Apple macOS Sonoma to a version that resolves this vulnerability.

    Fixed in 14.8.5
  13. Upgrade

    Upgrade Apple macOS Tahoe to a version that resolves this vulnerability.

    Fixed in 26.4
  14. Upgrade

    Upgrade Apple macOS Tahoe to a version that resolves this vulnerability.

    Fixed in 26.7.2
  15. Upgrade

    Upgrade Apple visionOS to a version that resolves this vulnerability.

    Fixed in 26.4
  16. Upgrade

    Upgrade Apple watchOS to a version that resolves this vulnerability.

    Fixed in 26.4

Event History

Mar 24, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Mar 25, 2026
CVE Published
via MITRE·12:35 AM
Data Sourced
via MITRE·12:35 AM
DescriptionWeakness
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2026-28864?

CVE-2026-28864 has been assessed as a high-severity vulnerability due to its impact on authentication and authorization mechanisms.

2

How do I fix CVE-2026-28864?

To fix CVE-2026-28864, upgrade your device to the latest version available, as recommended by Apple.

3

Which Apple products are affected by CVE-2026-28864?

CVE-2026-28864 affects various Apple products including iOS, iPadOS, macOS, watchOS, and visionOS versions prior to specified updates.

4

What types of issues does CVE-2026-28864 address?

CVE-2026-28864 addresses authentication and authorization issues along with path handling vulnerabilities.

5

Is there a patch for CVE-2026-28864?

Yes, there is a patch available that can be applied by updating your affected Apple devices to the latest software version.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203