Security readout for executives and security teams
Plain-English summary
A maliciously crafted image can corrupt memory when processed by affected Apple devices. Apple fixed the issue across supported iPhone, iPad, Mac, Apple TV, Vision Pro, and Apple Watch releases. The stated impact is unauthorized disclosure of sensitive information, making timely fleet updates important.
Executive priority
Treat as a high-priority fleet patching issue because malicious image processing may expose sensitive information without privileges or user interaction. Expedite updates on externally exposed and high-value devices. Emergency incident response is not supported solely by the supplied evidence because active exploitation has not been reported.
Technical view
CVE-2026-28990 is a CWE-119 memory-handling flaw triggered by processing a malicious image. It carries CVSS 3.1 score 7.5: network-accessible, low complexity, no privileges or user interaction, with high confidentiality impact. Apple addressed it through improved memory handling in the listed operating-system releases.
Likely exposure
Potential exposure includes Apple devices running releases earlier than the specified fixes and processing untrusted images. The bundle does not identify the vulnerable component or reliable affected-version boundaries; its affected-version entries contain unusable zero values. Confirm exposure using installed OS versions and Apple advisories.
Exploitation context
The supplied sources do not report active exploitation, public exploit availability, or inclusion in CISA KEV. KEV is marked false. The network-accessible, low-complexity CVSS assessment increases concern, but exploitability beyond the stated malicious-image condition cannot be established from this bundle.
Researcher notes
The record describes memory corruption and assigns CWE-119, but omits the affected component, root-cause detail, precise vulnerable ranges, and crash behavior. CVSS indicates confidentiality loss without integrity or availability impact. Testing should remain defensive and focus on version verification and vendor-advisory correlation rather than assuming code execution.
Mitigation direction
- Update affected devices to the listed fixed release or a newer vendor-supported release.
- Prioritize devices that receive or process images from untrusted or external sources.
- Review the linked Apple advisories for platform-specific deployment guidance and prerequisites.
- Track devices unable to update and escalate them for replacement or vendor-supported risk treatment.
Validation and detection
- Inventory OS versions across all Apple device classes in scope.
- Confirm iOS and iPadOS devices run 18.7.10, 26.5, or a newer applicable release.
- Confirm Macs run Sequoia 15.7.7, Sonoma 14.8.7, Tahoe 26.5, or newer applicable releases.
- Confirm tvOS, visionOS, and watchOS devices run 26.5 or newer.
- Re-scan or re-query managed devices after deployment and investigate update failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28990 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/127110CVE reference, apple
- https://support.apple.com/en-us/127115CVE reference, apple
- https://support.apple.com/en-us/127116CVE reference, apple
- https://support.apple.com/en-us/127117CVE reference, apple
- https://support.apple.com/en-us/127118CVE reference, apple
- https://support.apple.com/en-us/127119CVE reference, apple
- https://support.apple.com/en-us/127120CVE reference, apple
- https://support.apple.com/en-us/148287CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.