Overview
CVE-2026-28928 is a critical use-after-free vulnerability affecting the full Apple platform ecosystem — iOS, iPadOS, macOS Tahoe, tvOS, and watchOS. With a CVSS base score of 9.8, the flaw allows a malicious app to cause unexpected system termination, which can be leveraged for denial-of-service or, in combination with other weaknesses, for further exploitation.
Apple addressed the issue in the July 2026 security release wave through improved memory management.
Affected Systems
| Product | Fixed Version |
|---|---|
| iOS | 26.6 |
| iPadOS | 26.6 |
| macOS Tahoe | 26.6 |
| tvOS | 26.6 |
| watchOS | 26.6 |
Technical Details
Use-after-free (UAF) bugs occur when a program continues to use a pointer after the memory it references has been freed. In this instance, the vulnerability resides in an Apple platform system component shared across their device families, which explains the broad scope of impact.
Exploitation requires a malicious application to run on the target device. The primary demonstrated impact is unexpected system termination (kernel panic / device crash), but UAF vulnerabilities are frequently chained with information disclosure or privilege escalation primitives in sophisticated attacks.
Risk Assessment
- CVSS Score: 9.8 (Critical)
- Attack Vector: Local (requires malicious app execution)
- Impact: System termination; potential for further exploitation via chaining
- Exploit Status: No public exploit reported at time of disclosure
- Breadth: Affects the entire Apple ecosystem (iPhone, iPad, Mac, Apple TV, Apple Watch)
Recommended Actions
- Update all Apple devices — iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6
- Enforce MDM policies to require minimum OS versions on managed devices within your organization
- Audit sideloaded or enterprise-provisioned apps — UAF exploits typically require a foothold via a malicious app
- Monitor device crash logs via Apple Configurator or MDM solutions for patterns indicating exploitation
- Prioritize mobile fleet updates given the wide blast radius across Apple device types
References
- NVD Entry — CVE-2026-28928
- Apple Security Updates (iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6)