HowToFixMe
● High · CVSS 7.5

How to Fix CVE-2026-28983: Type Confusion Denial-of-Service in Apple iOS, iPadOS and macOS

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Last verified: 2026-06-16

CVE-2026-28983 is a type confusion bug that runs through almost the whole Apple OS family at once: iOS, iPadOS, macOS Tahoe, tvOS, visionOS and watchOS. A remote attacker can reach it over the network, without logging in and without the victim tapping anything, and the result is a denial of service - the affected process or the device itself crashes. Apple already shipped the fix. On iPhone and iPad the patched builds are iOS/iPadOS 18.7.9 (for the iOS 18 track) and iOS/iPadOS 26.5 (for the iOS 26 track); macOS, tvOS, visionOS and watchOS are all fixed in their 26.5 releases. The fix here is not a server package upgrade - it is a Settings-app software update on each device, and this page walks through that for every product in the list.

⚡ At a glance
ProductApple iOS, iPadOS, macOS Tahoe, tvOS, visionOS, watchOS
SeverityCVSS 7.5 - High (vector AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H)
ImpactRemote denial of service (availability only - no data read, no code execution)
Actively exploited?No - CISA SSVC Exploitation: none; not on the CISA KEV catalog
AffectediOS/iPadOS before 18.7.9 (18 track) and before 26.5 (26 track); macOS Tahoe before 26.5; tvOS, visionOS and watchOS before 26.5
Fixed iniOS/iPadOS 18.7.9 and 26.5; macOS Tahoe 26.5; tvOS 26.5; visionOS 26.5; watchOS 26.5
Type (CWE)CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Attacker requirementNetwork access to the device; no authentication, no user interaction

Exploitation status

CISA's ADP vulnrichment recorded an SSVC assessment for this CVE with Exploitation: none. In plain terms: no observed exploitation and no public proof-of-concept at the time the record was enriched. The CVE is also not on the CISA Known Exploited Vulnerabilities catalog, so there is no federal remediation deadline attached to it. Apple's own advisories do not carry an "exploited in the wild" note for this entry, which is the marker Apple uses when it knows a bug is being attacked.

The same SSVC block flags Automatable: yes and Technical Impact: partial. Automatable-yes matters here: the bug needs no authentication and no user interaction, so once a working trigger exists it is the kind of thing that can be sprayed at many devices cheaply. That is the reason to update on a normal-priority schedule instead of sitting on it - the impact is a crash, not a full takeover, but the barrier to triggering it is low.

Public exploit availability: no public exploit and no Metasploit module is linked in this CVE's primary references. That does not prove private exploit code does not exist, so do not read "none" as "never."

Authoritative references:

What is CVE-2026-28983?

CVE-2026-28983 is a type confusion flaw, classified as CWE-843, "access of resource using incompatible type." Apple's own one-line summary is short and precise: "A type confusion issue was addressed with improved checks."

Type confusion is a specific memory-safety mistake. Somewhere in the affected code, a chunk of data is created as one type - say, an object with a particular layout and a particular set of fields - and then later handled as if it were a different, incompatible type. When the code reads or writes through that mismatched view, it ends up touching memory it was never meant to touch in that way. In a parser or a frame handler, the usual visible symptom is a crash: the code dereferences something that isn't laid out the way it expected and the process falls over.

What makes this one notable is its reach. Apple shipped the same fix across iOS, iPadOS, macOS Tahoe, tvOS, visionOS and watchOS in the same release wave. When a single fix lands on that many platforms at once, it almost always sits in shared Apple framework code - the common libraries (media, networking, image or font handling, and the like) that every Apple OS links against. The advisory does not name the exact component in the public text, so I am not going to guess which framework; what the record does tell us is the shape of the problem and how to reach it.

The CVSS vector - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - fills in the attack preconditions. AV:N means the attacker works over the network, not from a local app already on the device. AC:L means low complexity, no special timing or race needed. PR:N means no privileges or account required. UI:N is the important one: the victim does not have to tap, open, or accept anything. And the impact triplet is C:N / I:N / A:H - no confidentiality loss, no integrity loss, high availability loss. So the realistic outcome is a forced crash or hang, not data theft or code execution. Apple's problem-type text agrees: "A remote attacker may be able to cause a denial of service." Full detail is in the Apple advisory and the NVD entry.

Why this CVE matters

Read the impact honestly and this is a 7.5, not a 10. The CVSS triplet is availability-only: an attacker can make the affected process or device fall over, but the vector explicitly rates confidentiality and integrity at none. So nobody is reading your messages or running their own code through this bug on its own. What they can do is knock the target offline.

That sounds mild until you think about where these devices live. A denial of service that needs no login and no tap is a reliable annoyance against anything that has to stay reachable: an Apple TV running signage in a lobby, a fleet of iPads on a shop floor or in a hospital, a Mac sitting on a network handling some service, a roomful of phones on a shared Wi-Fi network. "Automatable: yes" in the SSVC data is the part I'd weight: a bug that can be triggered remotely with no interaction is the kind of thing that gets scripted and fired at a whole subnet at once. The damage per hit is a crash, but a crash you can repeat at will is its own problem.

There is a second reason not to shrug it off. Type confusion bugs are frequently better than their first triage suggests. The public rating here is denial of service, but the same class of flaw is a classic stepping stone in chained attacks against Apple platforms. I am not claiming this specific CVE does more than the record says - it doesn't, on paper. But "it's only a crash" is a weak reason to leave a no-auth, no-interaction network bug unpatched when Apple has already shipped the fix. Update it.

Am I affected?

Check the OS version on each device. If it is older than the fixed build for its track, this CVE applies. Here is where to read the version on each Apple platform:

If you manage Apple devices at scale, your MDM is the faster way to read this. In a fleet console you can pull the OS version attribute for every enrolled device and filter for anything below the fixed build:

Filter: OS Version  is less than  18.7.9   (iOS 18 track devices)
Filter: OS Version  is less than  26.5     (iOS 26 / iPadOS 26 / macOS / tvOS / visionOS / watchOS 26 track)

On a Mac you can also read the build from Terminal, which is handy for scripted inventory:

# Run on the Mac itself (macOS Tahoe). Prints e.g. 26.5
sw_vers --productVersion

How to fix CVE-2026-28983

The fix is a software update from Apple. There is no package manager, no firmware image to flash by hand, and nothing to compile. On each device you install the build Apple named for that platform. The target versions are: iOS/iPadOS 18.7.9 (iOS 18 track) or iOS/iPadOS 26.5 (iOS 26 track), macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

iPhone and iPad

  1. Open Settings → General → Software Update.
  2. If you are staying on iOS 18, the device offers 18.7.9. If you have moved to iOS 26, it offers 26.5. Either one contains the fix - install whichever your device shows.
  3. Tap Update Now (or Download and Install). Keep the device on Wi-Fi and on power until it reboots and finishes.
  4. While you are there, turn on Automatic Updates so the next one lands without you chasing it.

Mac (macOS Tahoe)

  1. Open the Apple menu → System Settings → General → Software Update.
  2. Let it check, then install macOS Tahoe 26.5.
  3. The Mac will restart to apply the update. Save your work first.

Apple TV (tvOS)

  1. On the Apple TV, open Settings → System → Software Updates.
  2. Select Update Software and install tvOS 26.5.
  3. Turn on Automatically Update in the same screen so signage and shared units stay current without a manual visit.

Apple Watch (watchOS)

  1. On the watch: Settings → General → Software Update; or on the paired iPhone open the Watch app → General → Software Update.
  2. Install watchOS 26.5. The watch needs to be on its charger, above roughly 50% battery, and near the paired iPhone on Wi-Fi for the update to run.

Apple Vision Pro (visionOS)

  1. Open Settings → General → Software Update.
  2. Install visionOS 26.5 and let the headset finish the reboot.

Managed fleets (MDM)

For a fleet, push the update from your MDM rather than walking to every device. In a console such as Jamf, Kandji, Intune or Apple Business Manager you schedule a software-update command that targets the fixed OS version. On supervised iPhones, iPads and Macs you can force the install and set a deadline:

# MDM software-update intent (concept - set in your console's UI/API)
Target track 18:  enforce OS version  18.7.9   on iOS 18 devices
Target track 26:  enforce OS version  26.5     on iOS 26 / iPadOS 26 / macOS / tvOS / visionOS / watchOS 26 devices
Install action:   DownloadAndInstall (or InstallASAP)
Deadline:         set a date; supervised devices auto-install at the deadline

After the rollout, pull the OS-version inventory again and confirm no enrolled device still reports a build below the fixed version.

If you can't patch immediately

The update is the real fix. If a device genuinely cannot take it right now - a kiosk mid-event, a unit you can't reboot until a maintenance window - these steps shrink the exposure. They do not remove the bug.

One thing this CVE does not warrant: a WAF signature. There is no web application here to put rules in front of - these are client operating systems, and the impact is a crash on the device, not a request against a server you control. Don't waste a change window writing WAF rules for it.

How to verify the fix worked

Verification here is a version check, full stop. There is no service to probe and no scan signature that beats simply reading the build number. After the update, confirm each device reports the fixed version:

# On a Mac: confirm you are at or above the fixed build
sw_vers --productVersion        # expect 26.5 or later

If you ran the rollout through MDM, the cleanest verification is a fleet-wide query: pull the OS-version attribute for every enrolled device and confirm none still sits below the fixed build for its track. An empty "below 26.5 / below 18.7.9" result set is your proof the fix landed everywhere. Because the impact is a denial of service with no confidentiality or integrity loss, there are no credentials to rotate and no data exposure to chase after the fact - the version bump is the whole remediation.

Frequently asked questions

Is CVE-2026-28983 being exploited in the wild?

No. CISA's ADP assessment records SSVC Exploitation as "none," and the CVE is not on the CISA Known Exploited Vulnerabilities catalog. There is no public exploit linked in the record, and Apple's advisory does not carry its "exploited in the wild" note for this entry. It still deserves a prompt update because the impact is a remote, no-interaction denial of service.

What does CVE-2026-28983 actually let an attacker do?

It is a type confusion bug (CWE-843). The CVSS vector is AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, so an unauthenticated remote attacker can trigger it over the network with no user interaction, and the only impact is availability - a crash or hang. On its own it does not read your data or run code. The base score is 7.5 (High).

Which versions fix it, and I'm on iOS 18 not iOS 26 - am I covered?

Apple fixed it in iOS/iPadOS 18.7.9 and 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5 and watchOS 26.5. The fix shipped on both iPhone/iPad tracks, so if you are staying on iOS 18, update to 18.7.9; if you have moved to iOS 26, update to 26.5. Either build contains the fix.

Should I write a WAF or firewall rule for this?

A WAF makes no sense here - there is no web app, just client operating systems, and the impact is a device crash, not a server request. Network containment (keeping affected devices off untrusted networks and segmenting fleets) buys time, but it is not a fix. The OS update is the only thing that removes the bug.

Related weaknesses in the same component worth addressing at the same time:

References

Assembled from Apple's security release notes, the NVD record, and CISA's ADP vulnrichment data for CVE-2026-28983. Last verified 2026-06-16. Always confirm against Apple's advisory before applying changes to managed devices.