CVE-2026-28981

CVE-2026-28981 is a buffer overflow in macOS image processing that Apple rates as capable of arbitrary code execution, yet the CVSS base score is 7.8 and the EPSS projects only 0.00154 probability of exploitation in the wild. That gap is analytically significant and warrants ignoring the score for threat modeling purposes. The vulnerability lives in Apple's image processing stack — most likely ImageIO or CoreGraphics, which handle image format parsing across Safari, Preview, Mail, Messages, and countless third-party applications. The "improved bounds checking" language in Apple's advisory tells you this is a classic parsing vulnerability: code that processes image metadata without validating buffer limits. This pattern has appeared in CVE-2022-32898, CVE-2021-30807, CVE-2020-27912, and now this iteration. The recurring signature across multiple macOS versions isn't coincidence — it's architectural debt. These frameworks process image formats that predate modern secure development practices, and patches seal cracks without excavating the foundation. The 7.8 score likely reflects Apple's internal threat model: the vulnerable path requires a delivery mechanism (user opening a file, or a sandboxed app processing untrusted input). But that model collapses three distinct blast radius profiles — Sequoia, Sonoma, and Tahoe — into a single number. Each OS version ships with different default service configurations and auto-invocation patterns for ImageIO. A buffer overflow triggered passively through a web image in Safari on a default Sequoia install is a fundamentally different exposure than the same flaw on a developer beta running preview services. Treat image processing as an untrusted input boundary regardless of the CVSS score. Audit which applications in your environment invoke ImageIO APIs for thumbnail generation, document preview, or attachment parsing — this includes many third-party apps that layer on top of the framework. The low EPSS reflects production exploitation probability, not proof-of-concept availability. Historical precedent shows that similar framework-level ImageIO flaws have been weaponized in targeted attacks before patches deployed at scale. Monitor patch quality across all three OS versions. The three-version fix indicates the vulnerable code was tangled with version-specific dependencies — a common source of post-patch regressions. The temporal arc itself is a signal: the vulnerability circulated long enough to be discovered, reported, triaged, and patched across branches before disclosure. Equivalent windows likely remain open in the same architectural layer, carrying the same recurring signature.

Reviewed through automated stages and approved by a human before publication.