The vulnerability is a use‑after‑free flaw discovered in Apple operating systems. Application code can free an object that the still holds references to, after which the freed memory is reused. A malicious app that triggers this condition can write arbitrary data to kernel memory and can cause the system to terminate unexpectedly. The flaw is classified as CWE‑416 and presents a risk of kernel memory corruption.

The issue affects various Apple platforms. On iOS and iPadOS, devices running any release prior to iOS 18.7.7 or iPadOS 18.7.7, and prior to iOS 26.4 or iPadOS 26.4, are vulnerable. macOS is affected on Sequoia 15.7.5 and Tahoe 26.4 releases and earlier. The same applies to tvOS 26.4 and watchOS 26.4. The problem was addressed and fixed in the listed releases, and higher‑version updates are recommended.

The CVSS score of 7.1 indicates a high impact vulnerability. The EPSS score of less than 1 % indicates low probability of exploitation in the wild. It is not listed in CISA's KEV catalog, suggesting no widespread exploitation has been reported. The likely attack vector is local; a malicious application that runs on the device can exploit the use‑after‑free to corrupt kernel memory, potentially causing a crash or creating a foothold for more severe damage. This inference is based on the nature of the flaw described.