CVE-2026-28990 PUBLISHED

Assigner: apple
Reserved: 03.03.2026 Published: 11.05.2026 Updated: 11.05.2026

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

Product Status

Vendor	Apple
Product	iOS and iPadOS
Versions	affected from 0 to 26.5 (excl.)

Vendor	Apple
Product	macOS
Versions	affected from 0 to 14.8.7 (excl.) affected from 0 to 15.7.7 (excl.) affected from 0 to 26.5 (excl.)

Vendor	Apple
Product	tvOS
Versions	affected from 0 to 26.5 (excl.)

Vendor	Apple
Product	visionOS
Versions	affected from 0 to 26.5 (excl.)

Vendor	Apple
Product	watchOS
Versions	affected from 0 to 26.5 (excl.)

References

https://support.apple.com/en-us/127110
https://support.apple.com/en-us/127115
https://support.apple.com/en-us/127116
https://support.apple.com/en-us/127117
https://support.apple.com/en-us/127118
https://support.apple.com/en-us/127119
https://support.apple.com/en-us/127120

Problem Types

Processing a maliciously crafted image may corrupt process memory