CVE-2026-28991 is an out-of-bounds read vulnerability that was addressed by improved bounds checking. It affects multiple Apple operating systems including iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The flaw could allow an application to cause a denial-of-service condition. The issue is fixed in version 26.5 of these operating systems.