CVE-2026-28894: 
macOS vulnerability analysis and mitigation

CVE-2026-28894 is a denial-of-service vulnerability in Apple's Calling Framework component affecting iOS, iPadOS, and macOS. A remote attacker can exploit improper input validation to cause an affected system or application to become unresponsive or crash without requiring any authentication or user interaction. The vulnerability affects iOS and iPadOS prior to version 26.4, macOS Sonoma prior to 14.8.5, macOS Sequoia prior to 15.7.5, and macOS Tahoe prior to 26.4. It was disclosed and patched on March 24, 2026, with an additional patch release on May 11, 2026 covering iOS 18.7.9 and iPadOS 18.7.9. The CVSS v3.1 base score is 7.5 (High) (Apple iOS/iPadOS Advisory, Apple macOS Tahoe Advisory, Feedly).

The vulnerability is classified under CWE-20 (Improper Input Validation) and resides in Apple's Calling Framework component. An unauthenticated remote attacker can send specially crafted network input to trigger the denial-of-service condition, requiring no privileges and no user interaction (network-based, low complexity attack vector). Apple addressed the issue by implementing improved input validation in the affected component. The vulnerability was reported by an anonymous researcher and appears across all major Apple platforms sharing the same Calling Framework code (Apple iOS/iPadOS Advisory, Apple macOS Tahoe Advisory, Apple macOS Sequoia Advisory, Apple macOS Sonoma Advisory).

Successful exploitation results in a denial-of-service condition, causing the affected system or calling-related process to crash or become unresponsive. The impact is limited to availability — there is no confidentiality or integrity impact associated with this vulnerability. Affected assets include iPhones (iPhone 11 and later for iOS 26.4 branch; iPhone XS and later for iOS 18.7.9 branch), iPads, and Mac computers running vulnerable macOS versions. Because the attack is network-based and requires no authentication, it could be used to disrupt calling functionality on a large scale (Apple iOS/iPadOS Advisory, Feedly).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: iOS 26.4, iPadOS 26.4, macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, macOS Tahoe 26.4. An additional patch was released on May 11, 2026 for older devices via iOS 18.7.9 and iPadOS 18.7.9. No configuration-based workarounds have been published by Apple; updating to a patched version is the recommended and only known remediation (Apple iOS/iPadOS Advisory, Apple macOS Tahoe Advisory, Apple macOS Sequoia Advisory, Apple macOS Sonoma Advisory, Apple iOS 18.7.9 Advisory).

The vulnerability was included in Apple's March 2026 security update batch, which addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and tvOS, drawing broad coverage from security news aggregators. The SANS Internet Storm Center noted the release in its diary entries covering the March and May 2026 Apple security updates. CIS published an advisory noting multiple vulnerabilities in Apple products patched in this release cycle. No significant individual researcher commentary or social media discussion specific to CVE-2026-28894 has been identified, consistent with its moderate severity and lack of active exploitation (Feedly).