A use‑after‑free flaw in Apple’s operating systems allows memory to be corrupted when a process frees a resource and subsequently accesses it. An attacker who is able to communicate over Bluetooth with the device may induce the flaw, leading to arbitrary memory corruption that could, in the worst case, enable the execution of malicious code or the compromise of application integrity. The weakness is represented by CWE‑416, indicating a classic use‑after‑free vulnerability.

Affected releases include iOS 18.7.12, 26.7.3, and 27.2.1; iPadOS 18.7.12, 26.7.3, and 27.2.1; macOS Golden Gate 27.2.1, Sequoia 15.8.3, and Tahoe 26.7.3; visionOS 27.2.1; and watchOS 26.6.1 and 27.2.1. Devices operating on any of these builds are potentially susceptible until the corresponding patch is installed.

The exploit requires proximity through Bluetooth, so an attacker would need to be within typical wireless range of the target device. While no CVSS or EPSS score is listed, the use‑after‑free nature suggests a high impact if successfully triggered, and the lack of EPSS data means the likelihood of exploitation in the wild remains uncertain. The vulnerability is not yet listed in the CISA KEV catalog, but because the flaw can corrupt process memory, administrators should treat it with urgent attention.