HowToFixMe
● Medium · CVSS 6.2

How to Fix CVE-2026-28897: Apple Kernel Stack Buffer Overflow Across iOS, macOS, and watchOS

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Last verified: 2026-06-15

CVE-2026-28897 is a kernel-level stack buffer overflow that runs across nearly the whole Apple line: iPhone, iPad, Mac, Apple TV, Apple Vision Pro, and Apple Watch. A local app, one already running on the device, can hand the kernel malformed input that overruns a fixed stack buffer. The payoff for an attacker is narrow but real: crash the device, or read scraps of kernel memory it should never see. Apple fixed it by tightening input validation, and the patched builds are already out. The fix is simply to update the operating system. There are no Linux packages, Docker images, or web-server config files involved here, so this guide walks through the actual Settings and Software Update paths for each Apple platform.

⚡ At a glance
SeverityCVSS 3.1 base 6.2, Medium (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
ProductApple iOS & iPadOS, macOS, tvOS, visionOS, watchOS
Actively exploited?No (not on CISA KEV; CISA SSVC Exploitation: none)
AffectediOS/iPadOS before 18.7.9 and before 26.5; macOS before 14.8.7 (Sonoma), 15.7.7 (Sequoia), 26.5 (Tahoe); tvOS, visionOS, watchOS before 26.5
Fixed iniOS/iPadOS 18.7.9 & 26.5; macOS 14.8.7, 15.7.7, 26.5; tvOS 26.5; visionOS 26.5; watchOS 26.5
Attacker requirementLocal: code already executing on the device; no privileges, no user interaction
Type (CWE)CWE-121 Stack-based Buffer Overflow

Exploitation status

CVE-2026-28897 is not on the CISA Known Exploited Vulnerabilities catalog, and CISA's SSVC vulnrichment scores it Exploitation: none, Automatable: no, Technical Impact: partial. In plain terms: no confirmed in-the-wild abuse, and the flaw cannot be sprayed across the internet because it needs a local foothold first. That makes it a normal-priority update, not a drop-everything emergency. Still, kernel info-leaks are valuable to anyone building a jailbreak or a multi-stage spyware chain, so I would not let it sit for months.

Public exploit availability: Apple credits the fix to improved input validation and has not published proof-of-concept code. No public exploit appears in the primary references at the time of writing. Absence of a public PoC is not proof that private code does not exist, especially for kernel bugs that are attractive to commercial exploit brokers.

Authoritative references:

What is CVE-2026-28897?

CVE-2026-28897 is a stack-based buffer overflow (CWE-121) in the Apple operating-system kernel. The flaw lives in code that runs at the most privileged layer of the device, and it sits in nearly every modern Apple platform at once: iOS and iPadOS, macOS, tvOS, visionOS, and watchOS. Apple's own description is short and clinical: "A buffer overflow was addressed with improved input validation," with the consequence that "a local user may be able to cause unexpected system termination or read kernel memory."

Let me unpack what that means. A stack-based buffer overflow happens when code copies attacker-influenced data into a fixed-size region on the call stack without first checking that the data fits. The extra bytes spill past the buffer's edge and clobber whatever sits next on the stack: saved registers, return addresses, adjacent locals. In a kernel context that is dangerous, because the stack you are corrupting belongs to ring-0 code. The fix Apple shipped, "improved input validation," is the textbook remedy: the kernel now bounds-checks the input before the copy, so the oversized data is rejected instead of overrunning the buffer.

The precondition matters as much as the bug. Read the CVSS vector: AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. AV:L means the attack vector is local. An attacker cannot reach this over the network, over the web, or by getting you to open a malicious link. They need code already executing on the device. PR:N and UI:N mean that once that code is running, it needs no special privileges and no further user interaction to trigger the flaw. In practice this is a building block: a malicious or compromised app, or a process an attacker has already landed through some earlier bug, calls into the vulnerable kernel path with crafted input. The two documented outcomes are a forced kernel panic (the device reboots) or a read of kernel memory, which can leak pointers and secrets useful for defeating address-space layout randomization in a bigger exploit chain. Full technical detail is in the Apple security release and the NVD entry.

Why this CVE matters

On paper this is a Medium, 6.2. The CVSS metrics tell you why it is not a Critical. Confidentiality and integrity impacts are both scored None (C:N, I:N), and only availability is High (A:H), reflecting the clean kernel crash. So why bother updating quickly? Because the second half of Apple's own wording, the "read kernel memory" clause, is the part that worries exploit developers. A reliable kernel memory disclosure is one of the most prized primitives in iOS and macOS attack research. It is rarely the whole exploit. It is the piece that turns a fragile write bug into a working jailbreak or a full spyware implant by leaking the addresses needed to aim the next stage.

Who is exposed? Effectively every Apple user on an unpatched build, which is an enormous installed base. The mitigating factor is the local-only requirement. On iPhone and iPad that bar is genuinely high thanks to the App Store review pipeline and app sandbox. On macOS it is lower, because users routinely run software from outside the App Store. The realistic threat model is a device that already has something untrusted running on it (a sketchy sideloaded app, a configuration profile from a phishing campaign, or a foothold from a separate browser bug) using CVE-2026-28897 to escalate toward the kernel. The update closes that escalation path. No configuration change does.

Am I affected?

You are affected if any Apple device you manage runs an OS build older than the fixed version for its platform. Here is how to read your installed version and compare it.

iPhone / iPad: open Settings → General → About and read the Software Version. On the iOS 18 line you need 18.7.9 or later; on the iOS 26 line you need 26.5 or later. iPadOS uses the same numbers.

Mac: click the Apple menu → About This Mac, or run the command below in Terminal. Sonoma must be at 14.8.7, Sequoia at 15.7.7, and Tahoe at 26.5.

# macOS: print the product name and build
sw_vers
# Example output:
#   ProductName:    macOS
#   ProductVersion: 15.7.7
#   BuildVersion:   24H...

Apple TV: Settings → General → About (needs tvOS 26.5). Apple Vision Pro: Settings → General → About (needs visionOS 26.5). Apple Watch: in the Watch app on your iPhone, General → About, or on the watch itself Settings → General → About (needs watchOS 26.5). If your build number is below the fixed version for that platform, you are in the affected range and should update.

How to fix CVE-2026-28897

The fix is an operating-system update, delivered through Apple's built-in Software Update. There is nothing to download from a third party and nothing to compile. Pick the path that matches each device.

iPhone and iPad (iOS / iPadOS)

  1. Plug in or make sure the battery is healthy, and connect to Wi-Fi.
  2. Open Settings → General → Software Update.
  3. Install iOS/iPadOS 26.5 if you are on the current line. If your device stays on the iOS 18 line, install iOS/iPadOS 18.7.9, which is the back-ported fix for that release train.
  4. Let the device reboot, then re-check Settings → General → About to confirm the new version.

To stay patched automatically, turn on Settings → General → Software Update → Automatic Updates and enable both "Download" and "Install".

Mac (macOS)

Use System Settings, or drive it from Terminal if you manage a fleet:

# List available updates
softwareupdate --list

# Install everything that is pending, then restart when prompted
sudo softwareupdate --install --all --restart

# Target version after update:
#   Sonoma  -> 14.8.7
#   Sequoia -> 15.7.7
#   Tahoe   -> 26.5

Graphical path: Apple menu → System Settings → General → Software Update, then click Update Now (or Upgrade Now if moving to Tahoe 26.5). On an Apple silicon Mac you will be asked for your password to authorize the firmware portion of the update; that is expected.

Apple Watch, Apple TV, and Vision Pro

Managed fleets (MDM)

If you run devices under Jamf, Intune, Kandji, or another MDM, push the OS update through your declarative device-management or software-update command rather than relying on each user. Set the minimum enforced version to the fixed build for each platform (for example iOS 26.5, macOS 15.7.7 for Sequoia hosts) and stage a short deferral window so the panic-on-reboot does not surprise anyone mid-meeting.

If you can't patch immediately

Apple did not publish a configuration workaround for this bug, and honestly there is no clean one. The vulnerable code is in the kernel and is reachable by ordinary local code. Updating the OS is the fix. Until the update is installed, you can only shrink the chance that hostile local code ever runs:

A firewall or WAF rule does nothing here. This is not a network-reachable service, so there is no remote request to block.

How to verify the fix worked

Verification is a version check, full stop. Once the device reports the fixed build for its platform, the patched kernel is running.

# macOS: confirm you are at or above the fixed version
sw_vers --productVersion
#   acceptable: 14.8.7 (Sonoma), 15.7.7 (Sequoia), 26.5 (Tahoe) or later

On iPhone, iPad, Apple TV, Vision Pro, and Apple Watch, re-open Settings → General → About (or the Watch app) and read the software version back. If it matches or exceeds the fixed build listed in the at-a-glance table, you are done. For managed fleets, pull the OS-version inventory from your MDM and confirm no device still reports a build below the fixed version for its platform.

Frequently asked questions

Is CVE-2026-28897 being exploited in the wild?

No. It is not on CISA's KEV catalog, and CISA's SSVC assessment scores Exploitation as "none" and Automatable as "no". There is no public report of in-the-wild abuse at the time of writing. Because the bug needs a local app already running on the device, it is most useful as one link in a longer exploit chain rather than a standalone attack.

What is the CVSS score for CVE-2026-28897?

The CVSS 3.1 base score is 6.2 (Medium), vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The attack is local with no privileges and no user interaction, and the only scored impact is availability, a kernel crash. Apple separately notes that a local app may read kernel memory. Full detail is on the NVD entry.

Which Apple versions fix CVE-2026-28897?

iOS and iPadOS 18.7.9 (older line) and 26.5; macOS Sonoma 14.8.7, macOS Sequoia 15.7.7, and macOS Tahoe 26.5; tvOS 26.5; visionOS 26.5; and watchOS 26.5. Update to at least the version named for your platform.

Can a website or remote attacker trigger CVE-2026-28897?

No. The attack vector is Local, so an attacker needs code already executing on the device, such as an installed app, or a process landed through another bug. A firewall or web filter does not apply. Keeping sideloaded apps and untrusted configuration profiles off your devices is the practical control, and the OS update is the real fix.

Nearby vulnerabilities you may as well remediate alongside this fix:

References

Assembled from Apple's official security releases, the NVD record, and CISA's ADP vulnrichment (CVSS and SSVC) on 2026-06-15. Always confirm the version numbers against the Apple advisory for your specific device before updating.