CVE-2026-28879: 
macOS vulnerability analysis and mitigation

CVE-2026-28879 is a use-after-free vulnerability in Apple's Audio component that can be triggered by processing maliciously crafted web content, leading to an unexpected process crash. It was disclosed and patched on March 24, 2026, as part of Apple's March 2026 security update cycle. The vulnerability affects iOS and iPadOS (before 18.7.7 and before 26.4), macOS Sonoma (before 14.8.5), macOS Sequoia (before 15.7.5), macOS Tahoe (before 26.4), tvOS (before 26.4), visionOS (before 26.4), and watchOS (before 26.4). It carries a CVSS v3.1 base score of 6.5 (Medium), requiring user interaction but no privileges (Apple iOS 26.4 Advisory, Apple iOS 18.7.7 Advisory, Feedly).

The vulnerability is classified as CWE-416 (Use After Free) and resides in Apple's Audio component. When a user processes maliciously crafted web content — such as visiting a specially crafted webpage — the Audio subsystem accesses memory that has already been freed, resulting in an unexpected process crash. The attack vector is network-based, requires user interaction (e.g., visiting a malicious site or opening crafted content), and requires no privileges. The vulnerability was discovered and reported by Justin Cohen of Google (Apple iOS 26.4 Advisory, Apple macOS Sequoia Advisory). Apple addressed the issue with improved memory management.

Successful exploitation results in a denial-of-service condition via an unexpected process crash on the affected device. The impact is limited to availability — confidentiality and integrity are not affected according to the CVSS assessment. An unauthenticated remote attacker can trigger the crash by luring a user to view maliciously crafted web content, affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS devices running vulnerable versions (Feedly, Apple iOS 18.7.7 Advisory).

Apple has released patches across all affected platforms. Users should update to the following versions or later: iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. Until patching is complete, users should avoid viewing untrusted web content and restrict web browsing to trusted sources only (Apple iOS 26.4 Advisory, Apple iOS 18.7.7 Advisory, Apple macOS Sonoma Advisory).

The vulnerability was part of a large March 2026 Apple security update that addressed over 140 vulnerabilities across Apple's product ecosystem, which received broad coverage from security news outlets and industry blogs. The SANS Internet Storm Center published a diary entry noting the significance of the March 2026 Apple updates (SANS ISC). The CIS also issued an advisory noting multiple vulnerabilities in Apple products that could allow for privilege escalation (CIS Advisory). Community reaction was generally focused on the breadth of the update rather than this specific CVE, given its moderate severity and DoS-only impact.