A programming error caused a double free in memory management, which can be triggered by maliciously crafted web content. The flaw leads to an unexpected process crash rather than arbitrary code execution. The resulting loss of service can affect user experience and can potentially be leveraged to disrupt application availability. The vulnerability is a classic Use‑After‑Free condition and may be exploited by delivering crafted content through a web interface.

Apple devices running iOS and iPadOS as well as macOS Tahoe are affected when they run versions older than 26.5.2. The fix is included in iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. All earlier releases remain vulnerable.

The CVSS score of 6.5 indicates a moderate severity vulnerability, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The flaw remains a crash‑based denial of service that can be triggered remotely through malicious web pages containing crafted content. Remote denial of service would result in the affected process terminating unexpectedly, potentially degrading the user experience and, if critical, causing broader application unavailability. No widespread exploitation has been documented a yet, but the remote nature of the attack vector and the severity of the impact warrant proactive mitigation.