A use‑after‑free bug allows a local‑network attacker to corrupt the memory of a running process on Apple devices. The corrupted memory could be used to overwrite data, manipulate program flow, or ultimately execute arbitrary code or tamper with sensitive information. This vulnerability is catalogued as CWE‑416.

Apple iOS (18.4 and later), iPadOS (18.4 and later or 17.7.6 and later), macOS Sequoia (15.4 and later), macOS Sonoma (14.7.5 and later), macOS Ventura (13.7.5 and later), tvOS (18.4 and later), and visionOS (2.4 and later). Devices running earlier firmware are vulnerable.

The CVSS score of 8.8 indicates a high severity rating, but the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attacks would require the adversary to be on the same local network segment as the vulnerable device, which can be difficult to achieve remotely. While the likelihood is low, the potential impact is significant due to the possibility of arbitrary code execution.