This vulnerability (CVE-2026-28991) involves an out-of-bounds read in Apple iOS and iPadOS that could be triggered by a malicious app to cause a denial-of-service condition. The flaw was addressed by Apple through improved bounds checking in iOS 26.5 and iPadOS 26.5 releases. The CVSS score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. The vulnerability is categorized under CWE-125 (out-of-bounds read). No known exploits have been reported. Patch or remediation level is not explicitly stated in the source data, so checking official Apple advisories is recommended.

An attacker controlling a malicious app could exploit this vulnerability to cause a denial-of-service on affected iOS and iPadOS devices, disrupting availability. There is no impact on confidentiality or integrity. No known active exploitation has been reported.

Apple fixed this vulnerability in iOS 26.5 and iPadOS 26.5. Users and administrators should apply these updates to remediate the issue. Since no explicit patch status or vendor advisory content is provided here, confirm patch availability and update guidance from Apple's official security advisories before taking action.