This vulnerability (CVE-2026-28986) involves a race condition in Apple iOS and iPadOS that could allow an application to cause unexpected system termination, effectively a denial-of-service condition. The issue was addressed by Apple through additional validation checks in multiple OS versions including iOS 18.7.9 and iPadOS 18.7.9, among others. The CVSS v3.1 base score is 7.5, reflecting high severity due to the ease of network attack vector, no privileges required, and no user interaction needed. The vulnerability is categorized under CWE-362 (Race Condition). No known exploits have been reported in the wild. The vendor has released fixed versions, but explicit patch availability or vendor advisory content is not provided in the input data.

An attacker can cause unexpected system termination on affected Apple devices, resulting in denial of service. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without privileges or user interaction, increasing its risk. No known active exploitation has been reported.

Apple has fixed this vulnerability in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, and corresponding versions of macOS, tvOS, and watchOS. Users and administrators should apply these updates to mitigate the risk. Patch status is not explicitly confirmed in the provided data; therefore, verify the latest vendor advisory for current remediation guidance.