CVE-2026-28992

Published May 11, 2026·Updated Jun 17, 2026

NVD Description

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An attacker may be able to cause unexpected app termination.

Public Exploits & PoCs2 found

PoC: CVE-2026-28992-IOHIDFamily-FastPathUserClient-Race-Conditions

UAF and AOP coprocessor panic in IOHIDEventServiceFastPathUserClient. No entitlements, reachable from app sandbox.

PoC: IOHIDFamily-PoC-Research

CVE-2026-28992 IOHIDFamily FastPathUserClient race condition PoC — security research

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free