Resource Exhaustion in iOS and iPadOS

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: Apple Inc.

Description

A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-11

Last Modified

2026-05-11

Generated

2026-07-11

AI Q&A

2026-05-12

EPSS Evaluated

2026-07-10

NVD

CVE-2026-28872

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ios	to 18.7.9 (inc)
apple	ipad_os	to 18.7.9 (inc)
apple	ios	to 26.4 (inc)
apple	ipad_os	to 26.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a resource exhaustion issue caused by insufficient input validation. It allows a remote attacker to potentially cause a denial-of-service condition on affected Apple iOS and iPadOS devices.

Impact Analysis

The impact of this vulnerability is that a remote attacker may be able to cause a denial-of-service, which could make the affected device unresponsive or unavailable to the user.

Mitigation Strategies

To mitigate this vulnerability, update your devices to the fixed versions of the operating systems: iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, or iPadOS 26.4.

Hi! I’m here to help you understand CVE-2026-28872. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70