--- id: "CVE-2026-28928" page: "https://infrastack.ai/live/CVE-2026-28928" kind: "vulnerability" aliases: ["CVE-2026-28928"] title: "A use after free issue was addressed with improved memory management" severity: "critical" cvss: 9.8 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "iOS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["26.6"], "affected": "< 26.6", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.6"], "affected": "< 26.6", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.6"], "affected": ">= 26.0, < 26.6", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["26.6"], "affected": "< 26.6", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["26.6"], "affected": "< 26.6", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "ios", "ipad", "ipados", "iphone", "vendor", "vendor-advisory"] not_affected_if: ["already-on-ios-26.6"] published_at: "2026-07-27T21:16:49+00:00" first_seen_at: "2026-11-13T20:39:10+00:00" updated_at: "2026-11-13T21:27:25+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/128066", "first_seen_at": "2026-11-13T20:39:10+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/128067", "first_seen_at": "2026-11-13T20:39:13+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/128069", "first_seen_at": "2026-11-13T20:39:20+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28928", "first_seen_at": "2026-11-13T21:27:25+00:00"}] exploit_sources: [] --- # A use after free issue was addressed with improved memory management Link for people: https://infrastack.ai/live/CVE-2026-28928 (this .md is for agents) A use-after-free bug in the Apple Neural Engine component of iOS and iPadOS lets an app cause unexpected system termination. Apple's entry for this CVE describes only termination, not code execution or data access. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:iOS affected range not listed fixed no fixed version listed - vendor:apple ipados affected < 26.6 fixed 26.6 - vendor:apple iphone os affected < 26.6 fixed 26.6 - vendor:apple macos affected >= 26.0, < 26.6 fixed 26.6 - vendor:apple tvos affected < 26.6 fixed 26.6 - vendor:apple watchos affected < 26.6 fixed 26.6 ## How to check - Check the iOS or iPadOS version under Settings > General > About; versions below `26.6` are covered by this advisory. - Confirm the device model is one listed as available for (iPhone 11 and later, and the listed iPad models). ## Fix - iOS: `26.6` - iPadOS: `26.6` ## Timeline - 2026-11-13T20:39:10+00:00 lab https://support.apple.com/en-us/128066 — Apple: About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support - 2026-11-13T20:39:13+00:00 lab https://support.apple.com/en-us/128067 — Apple: About the security content of macOS Tahoe 26.6 - Apple Support - 2026-11-13T20:39:20+00:00 lab https://support.apple.com/en-us/128069 — Apple: About the security content of tvOS 26.6 - Apple Support - 2026-11-13T21:27:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28928 ## Documents - [advisory] Apple: About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support https://support.apple.com/en-us/128066 - [advisory] macOS Tahoe 26.6 security content https://support.apple.com/en-us/128067 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/128068 - [advisory] Apple: About the security content of tvOS 26.6 - Apple Support https://support.apple.com/en-us/128069 - [mentions] Apple: About the security content of tvOS 26.6 - Apple Support https://support.apple.com/en-us/128069 - [mentions] macOS Tahoe 26.6 security content https://support.apple.com/en-us/128067 - [mentions] Apple: About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support https://support.apple.com/en-us/128066 ## From the sources About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support # About the security content of iOS 26.6 and iPadOS 26.6 This document describes the security content of iOS 26.6 and iPadOS 26.6. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## iOS 26.6 and iPadOS 26.6 Released July 27, 2026 ### Accessibility Available for: iPhone 11 and later Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) ### Accounts Framework Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) ### App Store Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj ### Apple Account Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-65353: 章鱼哥@aipyaipy.com, Chris Bailey - Short Circuit, N.M.Praveen Nawarathne (@zblockrat), Stuart Wallace Entry added September 14, 2026 ### Apple Neural Engine Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun ### Apple Neural Engine Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence Entry added September 14, 2026 ### AppleAVD Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65407: Franco Belman at Blackwing Intelligence Entry added September 14, 2026 ### AppleDouble Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic, Rishabh Jain (rjcyber) of cyberplanet Entry updated September 14, 2026 ### Audio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) ### AuthKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel ### AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence ### BackgroundAssets Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab ### Books Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova ### CloudAttestation Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov ### Contacts Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams ### Contacts Available for: iPhone 11 and later, iPad Pro --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_