Vulnerability-Lookup

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "iPadOS versions ant\u00e9rieures \u00e0 26.5",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7.7",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iPadOS versions ant\u00e9rieures \u00e0 15.8.8",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8.7",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iPadOS versions ant\u00e9rieures \u00e0 17.7.11",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iPadOS versions ant\u00e9rieures \u00e0 18.7.9",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "tvOS versions ant\u00e9rieures \u00e0 26.5",
      "product": {
        "name": "tvOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "visionOS versions ant\u00e9rieures \u00e0 26.5",
      "product": {
        "name": "visionOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iPadOS versions ant\u00e9rieures \u00e0 16.7.16",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iOS versions ant\u00e9rieures \u00e0 16.7.16",
      "product": {
        "name": "iOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iOS versions ant\u00e9rieures \u00e0 18.7.9",
      "product": {
        "name": "iOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": " iOS versions ant\u00e9rieures \u00e0 26.5",
      "product": {
        "name": "iOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.5",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "watchOS versions ant\u00e9rieures \u00e0 26.5",
      "product": {
        "name": "watchOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iOS versions ant\u00e9rieures \u00e0 15.8.8",
      "product": {
        "name": "iOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-43668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43668"
    },
    {
      "name": "CVE-2026-28944",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28944"
    },
    {
      "name": "CVE-2026-1837",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1837"
    },
    {
      "name": "CVE-2026-28930",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28930"
    },
    {
      "name": "CVE-2026-28976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28976"
    },
    {
      "name": "CVE-2026-43656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43656"
    },
    {
      "name": "CVE-2026-28988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28988"
    },
    {
      "name": "CVE-2026-28951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28951"
    },
    {
      "name": "CVE-2026-28901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28901"
    },
    {
      "name": "CVE-2026-28915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28915"
    },
    {
      "name": "CVE-2026-28965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28965"
    },
    {
      "name": "CVE-2026-28913",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28913"
    },
    {
      "name": "CVE-2026-28987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28987"
    },
    {
      "name": "CVE-2026-28994",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28994"
    },
    {
      "name": "CVE-2026-28919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28919"
    },
    {
      "name": "CVE-2026-28882",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28882"
    },
    {
      "name": "CVE-2026-43661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43661"
    },
    {
      "name": "CVE-2026-28959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28959"
    },
    {
      "name": "CVE-2026-28873",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28873"
    },
    {
      "name": "CVE-2026-28947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28947"
    },
    {
      "name": "CVE-2026-43658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43658"
    },
    {
      "name": "CVE-2026-28840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28840"
    },
    {
      "name": "CVE-2026-28920",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28920"
    },
    {
      "name": "CVE-2026-28878",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28878"
    },
    {
      "name": "CVE-2026-39871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39871"
    },
    {
      "name": "CVE-2026-28961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28961"
    },
    {
      "name": "CVE-2026-28907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28907"
    },
    {
      "name": "CVE-2026-39869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39869"
    },
    {
      "name": "CVE-2025-43524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43524"
    },
    {
      "name": "CVE-2026-28953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28953"
    },
    {
      "name": "CVE-2026-39870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39870"
    },
    {
      "name": "CVE-2026-28963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28963"
    },
    {
      "name": "CVE-2026-28936",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28936"
    },
    {
      "name": "CVE-2026-28955",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28955"
    },
    {
      "name": "CVE-2026-28977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28977"
    },
    {
      "name": "CVE-2026-28940",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28940"
    },
    {
      "name": "CVE-2026-28903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28903"
    },
    {
      "name": "CVE-2026-28969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28969"
    },
    {
      "name": "CVE-2026-28848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28848"
    },
    {
      "name": "CVE-2026-28957",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28957"
    },
    {
      "name": "CVE-2026-28819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28819"
    },
    {
      "name": "CVE-2026-28872",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28872"
    },
    {
      "name": "CVE-2026-28846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28846"
    },
    {
      "name": "CVE-2026-28902",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28902"
    },
    {
      "name": "CVE-2026-28917",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28917"
    },
    {
      "name": "CVE-2026-28964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28964"
    },
    {
      "name": "CVE-2026-28894",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28894"
    },
    {
      "name": "CVE-2026-28950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28950"
    },
    {
      "name": "CVE-2026-28986",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28986"
    },
    {
      "name": "CVE-2026-28925",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28925"
    },
    {
      "name": "CVE-2026-28943",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28943"
    },
    {
      "name": "CVE-2026-28993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28993"
    },
    {
      "name": "CVE-2026-28924",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28924"
    },
    {
      "name": "CVE-2026-28990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28990"
    },
    {
      "name": "CVE-2026-28918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28918"
    },
    {
      "name": "CVE-2026-28996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28996"
    },
    {
      "name": "CVE-2026-28905",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28905"
    },
    {
      "name": "CVE-2026-28906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28906"
    },
    {
      "name": "CVE-2026-43655",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43655"
    },
    {
      "name": "CVE-2026-28972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28972"
    },
    {
      "name": "CVE-2026-28941",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28941"
    },
    {
      "name": "CVE-2026-28954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28954"
    },
    {
      "name": "CVE-2026-28877",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28877"
    },
    {
      "name": "CVE-2026-28956",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28956"
    },
    {
      "name": "CVE-2026-28974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28974"
    },
    {
      "name": "CVE-2026-43652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43652"
    },
    {
      "name": "CVE-2026-28908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28908"
    },
    {
      "name": "CVE-2026-43654",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43654"
    },
    {
      "name": "CVE-2026-28929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28929"
    },
    {
      "name": "CVE-2026-28971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28971"
    },
    {
      "name": "CVE-2026-28985",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28985"
    },
    {
      "name": "CVE-2026-28958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28958"
    },
    {
      "name": "CVE-2026-28995",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28995"
    },
    {
      "name": "CVE-2026-28922",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28922"
    },
    {
      "name": "CVE-2026-43653",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43653"
    },
    {
      "name": "CVE-2026-28914",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28914"
    },
    {
      "name": "CVE-2026-28942",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28942"
    },
    {
      "name": "CVE-2026-28946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28946"
    },
    {
      "name": "CVE-2026-28991",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28991"
    },
    {
      "name": "CVE-2026-28952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28952"
    },
    {
      "name": "CVE-2026-28962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28962"
    },
    {
      "name": "CVE-2026-28983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28983"
    },
    {
      "name": "CVE-2026-43660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43660"
    },
    {
      "name": "CVE-2026-28904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28904"
    },
    {
      "name": "CVE-2026-28978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28978"
    },
    {
      "name": "CVE-2026-28992",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28992"
    },
    {
      "name": "CVE-2026-43659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43659"
    },
    {
      "name": "CVE-2026-28923",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28923"
    },
    {
      "name": "CVE-2026-28870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28870"
    },
    {
      "name": "CVE-2026-43666",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43666"
    },
    {
      "name": "CVE-2026-28897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28897"
    },
    {
      "name": "CVE-2026-28883",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28883"
    },
    {
      "name": "CVE-2026-28847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28847"
    }
  ],
  "initial_release_date": "2026-05-12T00:00:00",
  "last_revision_date": "2026-05-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0563",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
  "vendor_advisories": [
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127114",
      "url": "https://support.apple.com/en-us/127114"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127117",
      "url": "https://support.apple.com/en-us/127117"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127115",
      "url": "https://support.apple.com/en-us/127115"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127118",
      "url": "https://support.apple.com/en-us/127118"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127110",
      "url": "https://support.apple.com/en-us/127110"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127111",
      "url": "https://support.apple.com/en-us/127111"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127113",
      "url": "https://support.apple.com/en-us/127113"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127116",
      "url": "https://support.apple.com/en-us/127116"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127119",
      "url": "https://support.apple.com/en-us/127119"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127120",
      "url": "https://support.apple.com/en-us/127120"
    },
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 127112",
      "url": "https://support.apple.com/en-us/127112"
    }
  ]
}

CVE-2026-28870 (GCVE-0-2026-28870)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:31 – Updated: 2026-04-02 18:11

Summary

An information leakage was addressed with additional validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to access sensitive user data.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

An app may be able to access sensitive user data

Assigner

apple

References

URL

Tags

	https://support.apple.com/en-us/126792
	https://support.apple.com/en-us/126794
	https://support.apple.com/en-us/126797
	https://support.apple.com/en-us/126798
	https://support.apple.com/en-us/126799

Impacted products

Vendor

Product

Version

Affected: 0 , < 26.4 (custom)

Apple	macOS	Affected: 0 , < 26.4 (custom)
Apple	tvOS	Affected: 0 , < 26.4 (custom)
Apple	visionOS	Affected: 0 , < 26.4 (custom)
Apple	watchOS	Affected: 0 , < 26.4 (custom)

Show details on NVD website

https://github.com/libjxl/libjxl/issues/4549

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-28870",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T19:45:16.836404Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T19:45:20.860Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An information leakage was addressed with additional validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to access sensitive user data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to access sensitive user data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:11:34.725Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126792"
        },
        {
          "url": "https://support.apple.com/en-us/126794"
        },
        {
          "url": "https://support.apple.com/en-us/126797"
        },
        {
          "url": "https://support.apple.com/en-us/126798"
        },
        {
          "url": "https://support.apple.com/en-us/126799"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-28870",
    "datePublished": "2026-03-25T00:31:50.087Z",
    "dateReserved": "2026-03-03T16:36:03.973Z",
    "dateUpdated": "2026-04-02T18:11:34.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1837 (GCVE-0-2026-1837)

Vulnerability from cvelistv5 – Published: 2026-02-11 15:19 – Updated: 2026-02-26 14:44

Title

libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2

Summary

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

Severity ?

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-805

Assigner

Google

References

URL

Tags

Impacted products

	Vendor	Product	Version
	Google	libjxl	Affected: 0.9 , ≤ 0.11.1 (semver)

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1837",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-13T04:56:38.683924Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T14:44:25.072Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/libjxl/libjxl/issues/4549"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libjxl",
          "vendor": "Google",
          "versions": [
            {
              "lessThanOrEqual": "0.11.1",
              "status": "affected",
              "version": "0.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA specially-crafted file can cause libjxl\u0027s decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.\u003c/p\u003e\u003cp\u003eThis can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).\u003c/p\u003e"
            }
          ],
          "value": "A specially-crafted file can cause libjxl\u0027s decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.\n\nThis can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-123",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-123 Buffer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-805",
              "description": "CWE-805",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-11T15:19:55.442Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://github.com/libjxl/libjxl/issues/4549"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2026-1837",
    "datePublished": "2026-02-11T15:19:55.442Z",
    "dateReserved": "2026-02-03T16:27:32.730Z",
    "dateUpdated": "2026-02-26T14:44:25.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28878 (GCVE-0-2026-28878)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:32 – Updated: 2026-04-02 18:21

Summary

A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to enumerate a user's installed apps.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE

An app may be able to enumerate a user's installed apps

Assigner

apple

References

URL

Tags

	https://support.apple.com/en-us/126792
	https://support.apple.com/en-us/126793
	https://support.apple.com/en-us/126794
	https://support.apple.com/en-us/126796
	https://support.apple.com/en-us/126797
	https://support.apple.com/en-us/126798
	https://support.apple.com/en-us/126799

Impacted products

Vendor

Product

Version

Affected: 0 , < 18.7.7 (custom)
Affected: 0 , < 26.4 (custom)

Apple	macOS	Affected: 0 , < 14.8.5 (custom) Affected: 0 , < 26.4 (custom)
Apple	tvOS	Affected: 0 , < 26.4 (custom)
Apple	visionOS	Affected: 0 , < 26.4 (custom)
Apple	watchOS	Affected: 0 , < 26.4 (custom)

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-28878",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T19:54:12.267906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T19:54:38.333Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to enumerate a user\u0027s installed apps."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to enumerate a user\u0027s installed apps",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:21:56.695Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126792"
        },
        {
          "url": "https://support.apple.com/en-us/126793"
        },
        {
          "url": "https://support.apple.com/en-us/126794"
        },
        {
          "url": "https://support.apple.com/en-us/126796"
        },
        {
          "url": "https://support.apple.com/en-us/126797"
        },
        {
          "url": "https://support.apple.com/en-us/126798"
        },
        {
          "url": "https://support.apple.com/en-us/126799"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-28878",
    "datePublished": "2026-03-25T00:32:37.601Z",
    "dateReserved": "2026-03-03T16:36:03.974Z",
    "dateUpdated": "2026-04-02T18:21:56.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28950 (GCVE-0-2026-28950)

Vulnerability from cvelistv5 – Published: 2026-04-22 18:22 – Updated: 2026-04-29 19:32

Summary

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2. Notifications marked for deletion could be unexpectedly retained on the device.

Severity ?

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

Notifications marked for deletion could be unexpectedly retained on the device

Assigner

apple

References

URL

Tags

	https://support.apple.com/en-us/127003
	https://support.apple.com/en-us/127002

Impacted products

Vendor

Product

Version

Affected: unspecified , < 18.7.8 (custom)

Affected: unspecified , < 26.4.2 (custom)

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-28950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T20:10:30.831549Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-359",
                "description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T20:12:34.310Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-29T19:32:15.824Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2026/Apr/14"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2026/Apr/15"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2. Notifications marked for deletion could be unexpectedly retained on the device."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Notifications marked for deletion could be unexpectedly retained on the device",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-22T18:22:39.313Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/127003"
        },
        {
          "url": "https://support.apple.com/en-us/127002"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-28950",
    "datePublished": "2026-04-22T18:22:39.313Z",
    "dateReserved": "2026-03-03T16:36:03.990Z",
    "dateUpdated": "2026-04-29T19:32:15.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28877 (GCVE-0-2026-28877)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:32 – Updated: 2026-04-02 18:14

Summary

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. An app may be able to access sensitive user data.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

An app may be able to access sensitive user data

Assigner

apple

References

URL

Tags

	https://support.apple.com/en-us/126792
	https://support.apple.com/en-us/126794
	https://support.apple.com/en-us/126795
	https://support.apple.com/en-us/126798
	https://support.apple.com/en-us/126799

Impacted products

Vendor

Product

Version

Affected: 0 , < 26.4 (custom)

Apple	macOS	Affected: 0 , < 15.7.5 (custom) Affected: 0 , < 26.4 (custom)
Apple	visionOS	Affected: 0 , < 26.4 (custom)
Apple	watchOS	Affected: 0 , < 26.4 (custom)

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-28877",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T19:15:14.081313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T19:15:38.195Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.7.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. An app may be able to access sensitive user data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to access sensitive user data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:14:37.655Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126792"
        },
        {
          "url": "https://support.apple.com/en-us/126794"
        },
        {
          "url": "https://support.apple.com/en-us/126795"
        },
        {
          "url": "https://support.apple.com/en-us/126798"
        },
        {
          "url": "https://support.apple.com/en-us/126799"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-28877",
    "datePublished": "2026-03-25T00:32:00.502Z",
    "dateReserved": "2026-03-03T16:36:03.974Z",
    "dateUpdated": "2026-04-02T18:14:37.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28882 (GCVE-0-2026-28882)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:31 – Updated: 2026-04-02 18:13

Summary

This issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to enumerate a user's installed apps.

Severity ?

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

An app may be able to enumerate a user's installed apps

Assigner

apple

References

URL

Tags

	https://support.apple.com/en-us/126792
	https://support.apple.com/en-us/126794
	https://support.apple.com/en-us/126797
	https://support.apple.com/en-us/126798
	https://support.apple.com/en-us/126799

Impacted products

Vendor

Product

Version

Affected: 0 , < 26.4 (custom)

Apple	macOS	Affected: 0 , < 26.4 (custom)
Apple	tvOS	Affected: 0 , < 26.4 (custom)
Apple	visionOS	Affected: 0 , < 26.4 (custom)
Apple	watchOS	Affected: 0 , < 26.4 (custom)

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-28882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T14:33:17.225938Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T14:33:20.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to enumerate a user\u0027s installed apps."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to enumerate a user\u0027s installed apps",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:13:43.383Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/126792"
        },
        {
          "url": "https://support.apple.com/en-us/126794"
        },
        {
          "url": "https://support.apple.com/en-us/126797"
        },
        {
          "url": "https://support.apple.com/en-us/126798"
        },
        {
          "url": "https://support.apple.com/en-us/126799"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-28882",
    "datePublished": "2026-03-25T00:31:56.588Z",
    "dateReserved": "2026-03-03T16:36:03.975Z",
    "dateUpdated": "2026-04-02T18:13:43.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28894 (GCVE-0-2026-28894)

Vulnerability from cvelistv5 – Published: 2026-03-25 00:31 – Updated: 2026-04-02 18:13

Summary

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A remote attacker may be able to cause a denial-of-service.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

A remote attacker may be able to cause a denial-of-service

Assigner

apple

References

URL

Tags

	https://support.apple.com/en-us/126792
	https://support.apple.com/en-us/126794
	https://support.apple.com/en-us/126795
	https://support.apple.com/en-us/126796

Impacted products

Vendor

Product

Version

Affected: 0 , < 26.4 (custom)

macOS

Affected: 0 , < 14.8.5 (custom)
Affected: 0 , < 15.7.5 (custom)
Affected: 0 , < 26.4 (custom)

Show details on NVD website