A use‑after‑free flaw was corrected with enhanced memory handling in Apple’s operating systems, allowing malicious applications to target freed memory regions and potentially elevate their privileges. The vulnerability, classified as CWE‑416, is specifically reported to enable privilege escalation when a malicious app exploits a released memory region that is still referenced. The description notes that the issue may have been actively exploited on iOS versions before iOS 17.2, indicating a real risk for older devices.

Apple’s major platforms – iOS, iPadOS, macOS, tvOS, visionOS, and watchOS – are impacted. The flaw is fixed in iOS 18.3, iPadOS 18.3 and 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, and watchOS 11.3.

The CVSS score of 10 denotes maximum severity, and an EPSS score of 16% suggests a moderate probability of exploitation. The vulnerability is listed in CISA’s KEV catalog, confirming a known exploitation window. Attackers would need to supply a malicious application that triggers the use‑after‑free; once the flaw is exploited, privileged escalation can be achieved, affecting the entire device.