CVE-2026-28990

Fix

Public exploits 1

• Billy-Ellis/exr-imageio-poc PoC on GitHub

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 7

• https://support.apple.com/en-us/127110 Release Notes, Vendor Advisory
• https://support.apple.com/en-us/127115 Release Notes, Vendor Advisory
• https://support.apple.com/en-us/127116 Release Notes, Vendor Advisory
• https://support.apple.com/en-us/127117 Release Notes, Vendor Advisory
• https://support.apple.com/en-us/127118 Release Notes, Vendor Advisory
• https://support.apple.com/en-us/127119 Release Notes, Vendor Advisory
• https://support.apple.com/en-us/127120 Release Notes, Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.