CVE-2026-28908: Buffer Overflow
Published May 11, 2026
·Updated
A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to modify protected parts of the file system.
Other sources
Accelerate. An out-of-bounds read was addressed with improved bounds checking.
— Apple
Accounts. A permissions issue was addressed with additional restrictions.
— Apple
APFS. A buffer overflow was addressed with improved bounds checking.
— Apple
App Intents. A logic issue was addressed with improved restrictions.
— Apple
AppleJPEG. A memory corruption issue was addressed with improved input validation.
— Apple
Credit
Vaagn Vardanian, Nathaniel Oh@@calysteon, beist, Yiğit Can YILMAZ@@yilmazcanyigit, popku1337(STAR Labs SG Pte), Billy Jheng Bing Jhong(STAR Labs SG Pte), Pan Zhenpeng@@Peterpan0927(STAR Labs SG Pte), Robert Tran, Aswin kumar Gokulakannan, Calif.io in collaboration with Claude, Anthropic Research, Csaba Fitzl@@theevilbit(Iru), Ryan Hileman via Xint Code (xint.io), Chris Betz(Talence Security), Tristan Madani@@TristanInSec(Talence Security), Dhiyanesh Selvaraj@@redroot97, Ruslan Dautov, Atul R V, Omar Cerrito, Anton Pakhunov, Ricardo Prado, Ian van der Wurff (ian.nl), Michael DePlante@@izobashi(TrendAI Zero Day Initiative), Dan Raviv, Ilya Sc. Jowell A., Peter Malone, Asaf Cohen, Doron Assness, Peter Malone(Supernetworks), Dave G.(Supernetworks), Alex Radocea(Supernetworks), Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Andy Koo@@andykoo(Hexens), Alex Radocea, Amy (amys.website), Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), an anonymous researcher, David Ige - Beryllium Security, Cantina, Luke Francis, kwak kiyong / kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox, Do Young Park, Yuhao Hu, Yuanming Lai, Chenggang Wu, Zhe Wang, DARKNAVY@@DarkNavyOrg(TrendAI Zero Day Initiative), Anonymous(TrendAI Zero Day Initiative), Daniel Rhea, Luka Rački, wac(TrendAI Zero Day Initiative), Kookhwan Lee(TrendAI Zero Day Initiative), Mateusz Krzywicki (iVerify.io), Maher Azzouzi, Aisle offensive security research team (Joshua Rogers(Calif), Luigino Camastra(Calif), Igor Morgenstern(Calif), (Calif), Guido Vranken)(Calif), Maher Azzouzi(Calif), Ngan Nguyen(Calif), dr3dd, Gia Bui@@yabeow(Calif), w0wbox, Milad Nasr, Nicholas Carlini with Claude, Anthropic, Khiem Tran, Kenneth Hsu(Palo Alto Networks), Jérôme DJOUDER, Wang Yu, Brendon Tiszka(Google Project Zero), Dave G., impost0r (ret2plt), David Ige(Beryllium Security), Arni Hardarson, Kun Peeks@@SwayZGl1tZyyy, Aswin Kumar Gokula Kannan, Suresh Sundaram, Jiri Ha, wdszzml, Atuin Automated Vulnerability Discovery Engine, Johnny Franks@@zeroxjf, Google Threat Analysis Group, Mihalis Haatainen, Ari Hawking, Ashish Kunwar, Robert Tran(STAR Labs SG Pte), Chris Betz, Morris Richman@@morrisinlife, Andrei Dodu, Zhongcheng Li(IES Red Team), Vamshi Paili, Tony Gorez for Reverse Society@@tonygo_, CVE-2026-1837, Niels Hofmans(TrendAI Zero Day Initiative), Somair Ansar, Seiji Sakurai@@HeapSmasher
Affected Software
6 affected componentsFixes available
Apple macOS Tahoe<26.5
26.5
Apple macOS Sonoma<14.8.7
14.8.7
Apple macOS Sequoia<15.7.7
15.7.7
Apple macOS>=14.0<14.8.7
Apple macOS>=15.0<15.7.7
Apple macOS>=26.0<26.5
Event History
May 11, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
CVE Published
via MITRE·08:07 PM
Data Sourced
via MITRE·08:07 PM
DescriptionWeakness
Data Sourced
via NVD·09:18 PM
DescriptionSeverityWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-28991
- CVE-2026-28988
- CVE-2026-28959
- CVE-2026-28995
- CVE-2026-1837
- CVE-2026-28956
- CVE-2026-39869
- CVE-2026-28922
- CVE-2026-28936
- CVE-2026-28918
- CVE-2026-28915
- CVE-2026-43659
- CVE-2026-28923
- CVE-2026-28925
- CVE-2026-43661
- CVE-2026-28977
- CVE-2026-28990
- CVE-2026-28978
- CVE-2026-28992
- CVE-2026-28943
- CVE-2026-28969
- CVE-2026-43655
- CVE-2026-43654
- CVE-2026-28908
- CVE-2026-28954
- CVE-2026-28897
- CVE-2026-28952
- CVE-2026-28951
- CVE-2026-28972
- CVE-2026-28986
- CVE-2026-28987
- CVE-2026-28983
- CVE-2026-28929
- CVE-2026-43653
- CVE-2026-28985
- CVE-2026-43668
- CVE-2026-43666
- CVE-2026-28941
- CVE-2026-28940
- CVE-2026-28961
- CVE-2026-28906
- CVE-2026-43656
- CVE-2026-43652
- CVE-2026-39870
- CVE-2026-28846
- CVE-2026-28993
- CVE-2026-28848
- CVE-2026-28930
- CVE-2026-28974
- CVE-2026-28996
- CVE-2026-28919
- CVE-2026-28924
- CVE-2026-39871
- CVE-2026-28976
- CVE-2026-43660
- CVE-2026-28907
- CVE-2026-28962
- CVE-2026-43658
- CVE-2026-28905
- CVE-2026-28847
- CVE-2026-28904
- CVE-2026-28955
- CVE-2026-28903
- CVE-2026-28953
- CVE-2026-28902
- CVE-2026-28901
- CVE-2026-28913
- CVE-2026-28883
- CVE-2026-28958
- CVE-2026-28917
- CVE-2026-28947
- CVE-2026-28946
- CVE-2026-28942
- CVE-2026-28971
- CVE-2026-28944
- CVE-2026-28819
- CVE-2026-28994
- CVE-2026-28914
- CVE-2026-28920
- CVE-2025-43524
- CVE-2026-28840
- CVE-2026-28878