CVE-2026-28935 in iPadOS
Summary
by MITRE • 09/14/2026
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability described involves a critical flaw in the operating systems iOS, iPadOS, macOS Sequoia and Tahoe, tvOS, visionOS, and watchOS, specifically related to improper memory handling within the kernel space. This type of issue typically stems from errors such as use-after-free conditions, buffer overflows, or race conditions during dynamic memory allocation and deallocation processes. When an application interacts with these system components, it can trigger a state where memory is accessed after it has been freed or written beyond its allocated boundaries. The root cause lies in the failure of the operating system to properly validate pointers or manage reference counts before allowing user-space applications to influence kernel-level operations. This represents a significant breakdown in the isolation mechanisms that are designed to prevent untrusted code from affecting core system stability and security integrity.
The operational impact of this vulnerability is severe, primarily manifesting as unexpected system termination or corruption of kernel memory. Unexpected system termination indicates that the flaw can lead to a denial-of-service condition by causing critical system processes to crash, resulting in device reboots or unresponsiveness for end-users. More critically, the potential for kernel memory corruption opens the door to privilege escalation attacks. If an attacker can carefully craft inputs to exploit this memory handling error, they may be able to overwrite specific data structures within the kernel, such as function pointers or security tokens. This could allow a malicious application running with standard user privileges to execute arbitrary code with elevated system rights, effectively gaining full control over the device. Such capabilities compromise confidentiality, integrity, and availability of all data stored on the affected devices.
From a classification perspective, this vulnerability aligns closely with CWE-120 Buffer Copy without Checking Size of Input or CWE-416 Use After Free, depending on the specific mechanism exploited within the memory management subsystem. In terms of offensive security frameworks like MITRE ATT&CK, this flaw facilitates techniques associated with Defense Evasion and Privilege Escalation, particularly those involving kernel exploitation to bypass user-level restrictions. The ability to corrupt kernel memory is a foundational step for many advanced persistent threats seeking to establish rootkits or maintain long-term access by hiding their presence from standard security monitoring tools that operate at the user level.
Apple has addressed this issue through improved memory handling mechanisms in the respective operating system updates. These fixes likely involve enhanced bounds checking, stricter validation of pointers before dereferencing them, and potentially the implementation of additional safeguards like kernel pointer authentication or hardened heap management techniques to mitigate exploitation attempts. Users are strongly advised to update their devices immediately to iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27. Delaying these updates leaves devices exposed to potential exploitation by malicious actors who may develop exploits targeting this specific memory handling flaw before the patch is widely deployed across all user bases.