Impact
A use‑after‑free bug in Apple operating systems can allow an arbitrary app to trigger a crash, leading to unexpected system termination. The flaw is caused by insufficient memory deallocation and is classified as CWE‑416. Apple has addressed the issue with improved memory management; the vulnerability is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.
Affected Systems
Apple’s iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.
Risk and Exploitability
The CVSS score of 9.8 highlights a high severity denial‑of‑service risk, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread publicly known exploits exist. Based on the description, the attack vector is inferred to be local, requiring the attacker to run a malicious or compromised app on the device; remote exploitation is not indicated by the available data. Immediate patching mitigates the risk.
OpenCVE Enrichment