CVE-2026-28841

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Tahoe 26.4. A buffer overflow may result in memory corruption and unexpected app termination.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/126794	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:29

Type	Values Removed	Values Added
Summary		(es) Un desbordamiento de búfer se abordó con una validación de tamaño mejorada. Este problema está solucionado en macOS Tahoe 26.4. Un desbordamiento de búfer puede provocar corrupción de memoria y la terminación inesperada de la aplicación.

25 Mar 2026, 18:24

Type	Values Removed	Values Added
References	~~() https://support.apple.com/en-us/126794 -~~	() https://support.apple.com/en-us/126794 - Release Notes, Vendor Advisory
First Time		Apple macos Apple
CPE		cpe:2.3:o:apple:macos::::::::

25 Mar 2026, 15:16

Type	Values Removed	Values Added
CWE		CWE-120
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.2

25 Mar 2026, 01:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-25 01:17

Updated : 2026-06-17 10:29

NVD link : CVE-2026-28841

Mitre link : CVE-2026-28841

CVE.ORG link : CVE-2026-28841

JSON object : View

Products Affected

apple

macos

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2026-28841", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28841", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T15:01:56.869300Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0", "lessThan": "26.4", "versionType": "custom"}]}]}], "published": "2026-03-25T01:17:08.987", "references": [{"url": "https://support.apple.com/en-us/126794", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Tahoe 26.4. A buffer overflow may result in memory corruption and unexpected app termination."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer se abord\u00f3 con una validaci\u00f3n de tama\u00f1o mejorada. Este problema est\u00e1 solucionado en macOS Tahoe 26.4. Un desbordamiento de b\u00fafer puede provocar corrupci\u00f3n de memoria y la terminaci\u00f3n inesperada de la aplicaci\u00f3n."}], "lastModified": "2026-06-17T10:29:09.133", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CF848CD-25D4-4371-BEF3-1ACCE47AD81F", "versionEndExcluding": "26.4", "versionStartIncluding": "26.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}