CVE-2026-28872
Received Received - Intake
Resource Exhaustion in iOS and iPadOS

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: Apple Inc.

Description
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-11
Generated
2026-06-21
AI Q&A
2026-05-12
EPSS Evaluated
2026-06-20
NVD
CVE-2026-28872
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
apple ios to 18.7.9 (inc)
apple ipad_os to 18.7.9 (inc)
apple ios to 26.4 (inc)
apple ipad_os to 26.4 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a resource exhaustion issue caused by insufficient input validation. It allows a remote attacker to potentially cause a denial-of-service condition on affected Apple iOS and iPadOS devices.

Impact Analysis

The impact of this vulnerability is that a remote attacker may be able to cause a denial-of-service, which could make the affected device unresponsive or unavailable to the user.

Mitigation Strategies

To mitigate this vulnerability, update your devices to the fixed versions of the operating systems: iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, or iPadOS 26.4.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart