Impact
A use‑after‑free flaw in Apple operating systems’ memory management has been addressed by improved memory handling. The issue, which was fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6, iPadOS 26.6, as well as macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, may still allow an application to trigger unexpected system termination. The flaw corresponds to CWE‑416 and can lead to denial of service by causing a crash when an app accesses freed memory.
Affected Systems
Apple iOS, iPadOS, macOS Sequoia, macOS Sonoma, macOS Tahoe, tvOS, visionOS, and watchOS. The flaw has been addressed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.
Risk and Exploitability
EPSS score of <1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 9.8 reflects critical severity, underscoring the risk of denial of service if triggered. The flaw can be triggered by an application that incorrectly accesses freed memory during its execution, leading to a crash. Attackers would need to run or entice the target system to run a malicious or vulnerable app, making the threat primarily local and application‑bound.
OpenCVE Enrichment