HowToFixMe
● Medium · CVSS 6.2

How to Fix CVE-2026-28985: Local-Network Denial-of-Service in iOS, iPadOS, macOS and tvOS

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Last verified: 2026-05-25

CVE-2026-28985 is a null pointer dereference in Apple's operating systems. Someone sitting on the same Wi-Fi or wired network as your iPhone, iPad, Mac, or Apple TV can send malformed traffic that crashes a system component, causing a denial-of-service. Apple patched it in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and tvOS 26.5. The fix is a normal software update from Settings, not a server package or command-line patch. Below I walk through exactly which versions are affected, how to read the version your device is running, how to install the update on each platform, and what to do if you cannot update straight away.

⚡ At a glance
ProductApple iOS, iPadOS, macOS (Tahoe) and tvOS
SeverityCVSS 3.1 base 6.2 - Medium (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Actively exploited?No - not on CISA KEV; CISA SSVC Exploitation: none, Automatable: no
Affected versionsiOS & iPadOS < 26.5; macOS < 26.5; tvOS < 26.5
Fixed iniOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5
Type (CWE)CWE-476 NULL Pointer Dereference (availability-only DoS)
Attacker requirementOn the same local network; no privileges, no user interaction

Exploitation status

CISA has not added CVE-2026-28985 to its Known Exploited Vulnerabilities (KEV) catalog, and CISA's SSVC assessment for this CVE records Exploitation: none, Automatable: no, and Technical Impact: partial. In short, there is no government-confirmed evidence of active exploitation. KEV listings can lag real exploitation, so still install the 26.5 update on your normal schedule rather than waiting for confirmation.

Public exploit availability: no public exploit or Metasploit module is linked in this CVE's primary references at the time of writing. That does not rule out private or unpublished exploit code. It is worth remembering that even a working exploit only yields a denial-of-service here, not data theft or code execution.

Authoritative references:

What is CVE-2026-28985?

CVE-2026-28985 is a null pointer dereference, classified as CWE-476, in Apple's iOS, iPadOS, macOS (the Tahoe release), and tvOS. Apple describes it plainly: a null pointer dereference that was addressed with improved input validation, and an attacker on the local network may be able to cause a denial-of-service.

Here is what that means in practice. A null pointer dereference happens when code follows a pointer that it assumes points to a valid object, but the pointer is actually null (it points to nothing). When a privileged system process inside the OS does that, the kernel or that process can no longer continue safely, so it crashes or panics. In this case the trigger is network input. The affected component parses traffic that arrives over the local network, and a specially crafted packet steers it down a path where it dereferences a pointer that was never set. Apple's fix is "improved input validation," which is the standard phrasing for adding a guard that checks the input (and rejects the malformed packet) before the pointer is ever used.

The attack preconditions are spelled out by the CVSS 3.1 vector that CISA's ADP team attached: AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Reading that left to right tells you exactly who can do this. The attack vector is local; combined with Apple's own wording ("an attacker on the local network"), the attacker has to be on the same Wi-Fi or wired segment as the target, not anywhere on the internet. Attack complexity is low, so no special timing or rare conditions are required. Privileges required is none and user interaction is none, so the victim does not have to tap, click, install, or open anything; the device just has to be reachable on the network. The scope is unchanged, and the impact triad is the important part: confidentiality none, integrity none, availability high. Nothing is read, nothing is altered. The only outcome is that the targeted device or service stops responding.

That impact profile is why the base score lands at 6.2, a Medium. A pure availability bug that needs local-network adjacency is meaningfully less dangerous than a remote code-execution flaw, and the numbers reflect that.

Why this CVE matters

Let me be honest about the real-world weight of this one, because over-hyping a Medium helps nobody. This is a denial-of-service, not a data breach and not a takeover. The CVSS vector says confidentiality and integrity impact are both none. An attacker who exploits CVE-2026-28985 cannot read your photos, cannot steal credentials, and cannot run their own code on the device. What they can do is knock the device or an OS service offline by feeding it the malformed network input that trips the null dereference.

Where that still bites is availability-sensitive settings. Picture a conference room full of Apple TVs driving displays, a fleet of iPads running point-of-sale or kiosk software, or Macs on a shared office LAN. Anyone already on that same network segment, including a guest on the same Wi-Fi or a compromised laptop in the building, can repeatedly crash those devices and disrupt whatever they are doing. For a home user the stakes are lower: the attacker still has to be on your network, and the worst case is a device that needs to recover or restart.

CISA's own triage backs up the moderate reading. The SSVC decision recorded in this CVE's data lists Exploitation as none, Automatable as no, and Technical Impact as partial. In plain terms: no observed exploitation, it does not lend itself to spray-and-pray mass attacks, and the technical impact is partial rather than total system control. So the honest priority is: patch it on your normal update cadence, move it up if a device is in an availability-critical role on an untrusted network, and do not lose sleep over a remote internet attacker, because this is not that kind of bug.

Am I affected?

You are affected if any Apple device on your network is running a build older than 26.5. The record marks every version below 26.5 as affected across all four platforms:

The fix shipped in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and tvOS 26.5, so any build at 26.5 or later already contains the patch. Checking your installed version takes a few seconds per device, and there is no command line involved because these are consumer operating systems, not server packages.

iPhone and iPad

  1. Open Settings.
  2. Tap General, then About.
  3. Read the Software Version (or iOS Version / iPadOS Version) line. If it shows 26.5 or higher you are patched; anything lower is affected.

Mac (macOS Tahoe)

  1. Click the Apple menu in the top-left corner.
  2. Choose About This Mac.
  3. Confirm the macOS version reads 26.5 or later.

If you prefer the Terminal on a Mac, sw_vers prints the same information:

sw_vers
# ProductName:    macOS
# ProductVersion: 26.5      <-- 26.5 or higher means patched

Apple TV

  1. Open Settings on the Apple TV.
  2. Go to System, then Software Updates (the current build is shown here).
  3. Confirm tvOS is at 26.5 or later.

How to fix CVE-2026-28985

The fix is an Apple software update to 26.5 (or later) on each platform. There is no package manager, no Docker image, and no PowerShell script involved; this is a consumer OS update delivered through Apple's own update channel. Updating one device does not update the others, so repeat for every iPhone, iPad, Mac, and Apple TV on your network.

Update iPhone and iPad

  1. Plug in or make sure the battery is healthy, and connect to Wi-Fi.
  2. Open Settings, tap General, then Software Update.
  3. Tap Update Now (or Upgrade to iOS/iPadOS 26.5) and let the device download, install, and restart.
  4. To stay current automatically, turn on Automatic Updates on the same screen.

Update Mac (macOS Tahoe 26.5)

  1. Open the Apple menu, then System Settings.
  2. Go to General, then Software Update.
  3. When macOS Tahoe 26.5 appears, click Update Now and allow the Mac to install and reboot.

For a managed Mac fleet you can trigger the same OS update from the command line with Apple's softwareupdate tool (run as an admin):

# List available updates, then install everything Apple offers
softwareupdate --list
sudo softwareupdate --install --all --restart

Update Apple TV (tvOS 26.5)

  1. Open Settings, go to System, then Software Updates.
  2. Select Update Software; if 26.5 is offered, choose Download and Install.
  3. Enable Automatically Update so future fixes arrive without manual steps.

If you manage these devices with an MDM such as Apple Business Manager, push the 26.5 update (or set the minimum OS version to 26.5) through your MDM's managed software update workflow rather than touching each device by hand.

If you can't patch immediately

Updating to 26.5 is the only thing that actually removes the bug. If a device cannot be updated right away, these steps reduce the chance an attacker can reach it, because the whole attack depends on local-network adjacency:

Because this flaw exposes no data and grants no code execution, there is no credential to rotate and no compromise to assume from exploitation alone. The mitigation goal is purely to keep availability up until 26.5 is installed.

How to verify the fix worked

Verification here is a version check, not a scan. The fix is present once the OS reports 26.5 or later, so confirm the build on each device after it restarts:

On a Mac the one-liner below makes the check unambiguous:

# Prints PATCHED only if macOS is 26.5 or newer
ver=$(sw_vers -productVersion)
printf 'macOS %s -> ' "$ver"
[ "$(printf '%s\n26.5\n' "$ver" | sort -V | head -n1)" = "26.5" ] && echo PATCHED || echo STILL-AFFECTED

For a managed fleet, your MDM's inventory or device-compliance report is the authoritative source: filter for any device below the 26.5 minimum and the list of remaining affected devices falls out directly. There is no behavioural test you need to run beyond confirming the build, because the patched OS simply rejects the malformed input that used to trigger the crash.

Frequently asked questions

Is CVE-2026-28985 being exploited in the wild?

No. It is not on CISA's KEV catalog, and CISA's SSVC assessment records Exploitation as none and Automatable as no. There is no confirmed in-the-wild use. Install the 26.5 update on your usual cadence; bring it forward for devices on untrusted networks.

Which Apple products and versions does CVE-2026-28985 affect?

iOS and iPadOS before 26.5, macOS (Tahoe) before 26.5, and tvOS before 26.5. Apple fixed it in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and tvOS 26.5.

What is the CVSS score and attack type for CVE-2026-28985?

The CVSS 3.1 base score is 6.2 (Medium), vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It is a null pointer dereference (CWE-476) that an attacker on the same local network can trigger to cause a denial-of-service. It does not expose or alter data; only availability is affected.

Can this CVE be exploited over the internet?

No. The attack vector is local network, so the attacker has to be on the same Wi-Fi or LAN segment as the device. It is not a remote-from-the-internet bug, and once an attacker is on that network it needs no privileges and no user interaction.

How do I confirm my Apple device is patched against CVE-2026-28985?

Check the OS version. On iPhone or iPad: Settings, General, About, and confirm 26.5 or later. On a Mac: Apple menu, About This Mac (or run sw_vers). On Apple TV: Settings, System, Software Updates. Any build at 26.5 or above contains the fix.

Related weaknesses in the same component worth addressing at the same time:

References

Assembled from the official Apple security advisories, the MITRE CVE record, and CISA's ADP/SSVC enrichment on 2026-05-25. CVE-2026-28985 is not currently listed on the CISA KEV catalog. Always confirm against the Apple advisory before acting in production.