CVE-2026-28901: Buffer Overflow
Published May 11, 2026
·Updated
Accelerate. An out-of-bounds read was addressed with improved bounds checking.
Other sources
Accounts. A permissions issue was addressed with additional restrictions.
— Apple
AirDrop. A reachable assertion was addressed with improved input validation.
— Apple
APFS. A buffer overflow was addressed with improved bounds checking.
— Apple
App Intents. A logic issue was addressed with improved restrictions.
— Apple
AppleJPEG. A memory corruption issue was addressed with improved input validation.
— Apple
Credit
Cantina, Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox, Do Young Park, Artem Dinaburg(Trail of Bits via Anthropic CVD), Yuhao Hu, Yuanming Lai, Chenggang Wu, Zhe Wang, Idan Masas(TrendAI Zero Day Initiative), DARKNAVY@@DarkNavyOrg(TrendAI Zero Day Initiative), Anonymous(TrendAI Zero Day Initiative), Daniel Rhea, Luka Rački, wac(TrendAI Zero Day Initiative), Kookhwan Lee(TrendAI Zero Day Initiative), Mateusz Krzywicki (iVerify.io), Maher Azzouzi, Tristan Madani@@TristanInSec(Talence Security), Nathaniel Oh@@calysteon, Aisle offensive security research team (Joshua Rogers(Calif), Luigino Camastra(Calif), Igor Morgenstern(Calif), (Calif), Guido Vranken)(Calif), Maher Azzouzi(Calif), Ngan Nguyen(Calif), an anonymous researcher, dr3dd, Gia Bui@@yabeow(Calif), w0wbox, Milad Nasr, Nicholas Carlini with Claude, Anthropic, Khiem Tran, lebr0nli(National Yang Ming Chiao Tung University), Security, Systems Lab, Kenneth Hsu(Palo Alto Networks), Jérôme DJOUDER, Arash Ale Ebrahim(SCy), Dave G., Vamshi Paili, Tony Gorez for Reverse Society@@tonygo_, CVE-2026-1837, impost0r (ret2plt), Nicholas Soh, David Ige(Beryllium Security), Alan Wang, Ailsa Sun, Christopher W. Fletcher, Hovav Shacham, David Kohlbrenner, Riccardo Paccagnella, Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), Niels Hofmans(TrendAI Zero Day Initiative), Alex Radocea, Gandalf4a(PKU), Anton Pakhunov, Suresh Sundaram, Jiri Ha, Arni Hardarson, Johnny Franks@@0xjohnny, Google Threat Analysis Group, Mihalis Haatainen, Ari Hawking, Ashish Kunwar, Richard Zana, Dhiyanesh Selvaraj@@redroot97, Somair Ansar, popku1337(STAR Labs SG Pte), Billy Jheng Bing Jhong(STAR Labs SG Pte), Pan Zhenpeng@@Peterpan0927(STAR Labs SG Pte), Robert Tran, Aswin kumar Gokulakannan, Csaba Fitzl@@theevilbit(Iru), Ryan Hileman via Xint Code (xint.io), Chris Betz(Talence Security), Ruslan Dautov, Zhongcheng Li (CK01), Atul R V, Omar Cerrito, Ricardo Prado, Ian van der Wurff (ian.nl), Michael DePlante@@izobashi(TrendAI Zero Day Initiative), Asaf Cohen, Ilya Sc. Jowell A., Peter Malone, Jorge Welch, Doron Assness, Andy Koo@@andykoo(Hexens), Adriatik Raci, Abhay Kailasia@@abhay_kailasia(Safran Mumbai India), Brendon Tiszka(Google Project Zero), Seiji Sakurai@@HeapSmasher, CVE-2025-14017, CVE-2025-14819, Kun Peeks@@SwayZGl1tZyyy, Aswin Kumar Gokula Kannan, wdszzml, Atuin Automated Vulnerability Discovery Engine, beist, Yiğit Can YILMAZ@@yilmazcanyigit, Calif.io in collaboration with Claude, Anthropic Research, Prathamesh Walunj@@attahasa, Dan Raviv, Surya Kushwaha(Supernetworks), Robert Tran(Supernetworks), Peter Malone(Supernetworks), Dave G.(Supernetworks), Alex Radocea(Supernetworks), Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Amy (amys.website), YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), David Ige - Beryllium Security, Wang Yu
Affected Software
13 affected componentsFixes available
Apple macOS Tahoe<26.5
26.5
Apple iOS<26.5
26.5
Apple iPadOS<26.5
26.5
Apple visionOS<26.5
26.5
Apple tvOS<26.5
26.5
Apple WatchOS<26.5
26.5
Apple iPadOS<26.5
Apple iPhone OS<26.5
Apple macOS>=26.0<26.5
Apple tvOS<26.5
Apple visionOS<26.5
Apple WatchOS<26.5
Apple Safari<26.5
26.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.5
Event History
May 11, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
Affected Software
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·08:08 PM
Data Sourced
via MITRE·08:08 PM
DescriptionWeakness
Data Sourced
via NVD·09:18 PM
DescriptionSeverityWeaknessAffected Software
May 13, 2026
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Jun 2, 2026
Data Sourced
via Red Hat·01:28 PM
DescriptionSeverityAffected Software
Jan 25, 58467
Event
via NVD·09:07 PM
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-43660
- CVE-2026-28907
- CVE-2026-28962
- CVE-2026-43658
- CVE-2026-28984
- CVE-2026-28905
- CVE-2026-28847
- CVE-2026-28904
- CVE-2026-28955
- CVE-2026-28903
- CVE-2026-28953
- CVE-2026-28902
- CVE-2026-28901
- CVE-2026-28913
- CVE-2026-28883
- CVE-2026-28958
- CVE-2026-28917
- CVE-2026-28947
- CVE-2026-28946
- CVE-2026-28942
- CVE-2026-28971
- CVE-2026-43670
- CVE-2026-28944
- CVE-2026-28991
- CVE-2026-28988
- CVE-2026-43667
- CVE-2026-28959
- CVE-2026-28995
- CVE-2026-1837
- CVE-2026-28956
- CVE-2026-39869
- CVE-2026-28964
- CVE-2026-28936
- CVE-2026-28918
- CVE-2026-43659
- CVE-2026-43661
- CVE-2026-28977
- CVE-2026-28990
- CVE-2026-28992
- CVE-2026-28943
- CVE-2026-28969
- CVE-2026-39877
- CVE-2026-43655
- CVE-2026-43654
- CVE-2026-28897
- CVE-2026-28951
- CVE-2026-28972
- CVE-2026-28986
- CVE-2026-28987
- CVE-2026-28983
- CVE-2026-43657
- CVE-2026-43653
- CVE-2026-28985
- CVE-2026-43668
- CVE-2026-43666
- CVE-2026-28940
- CVE-2026-65367
- CVE-2026-28906
- CVE-2026-43656
- CVE-2026-28846
- CVE-2026-28963
- CVE-2026-28993
- CVE-2026-28974
- CVE-2026-28957
- CVE-2026-28996
- CVE-2026-28994
- CVE-2026-28965
- CVE-2026-28920
- CVE-2026-28849
- CVE-2026-28922
- CVE-2026-28915
- CVE-2025-14017
- CVE-2025-14819
- CVE-2026-28923
- CVE-2026-28925
- CVE-2026-28978
- CVE-2026-28908
- CVE-2026-28954
- CVE-2026-28952
- CVE-2026-28900
- CVE-2026-28929
- CVE-2026-28941
- CVE-2026-28961
- CVE-2026-43652
- CVE-2026-39870
- CVE-2026-28848
- CVE-2026-28930
- CVE-2026-28919
- CVE-2026-28924
- CVE-2026-39871
- CVE-2026-28976
- CVE-2026-28819
- CVE-2026-28914
Frequently Asked Questions
1
What is the severity of CVE-2026-28901?
CVE-2026-28901 has a high severity due to its potential for exploitation through out-of-bounds read and buffer overflow vulnerabilities.
2
How do I fix CVE-2026-28901?
To fix CVE-2026-28901, update your Apple devices to version 26.5 or later.
3
What software is affected by CVE-2026-28901?
CVE-2026-28901 affects multiple Apple products including macOS Tahoe, iOS, iPadOS, visionOS, tvOS, watchOS, and Safari versions prior to 26.5.
4
What risks does CVE-2026-28901 pose to users?
CVE-2026-28901 can allow attackers to exploit vulnerabilities leading to unauthorized access or data leakage.
5
When was CVE-2026-28901 disclosed?
CVE-2026-28901 was disclosed as part of Apple's security updates released for version 26.5.