The vulnerability is a Use‑After‑Free that allows an application to invoke a deallocated memory region, causing the system to terminate unexpectedly. This results in a denial‑of‑service scenario where a malicious or poorly coded app can crash the operating system or a critical subsystem, disrupting user experience and potentially exposing application data during the crash. The weakness is identified as CWE‑416.

The flaw affects all major Apple operating systems: iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vendor has fixed the issue in the following releases: iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8 and macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

Though the EPSS score is less than 1%, indicating a very low likelihood of exploitation, the CVSS score of 9.8 underscores its critical severity. The vulnerability remains a high‑severity risk. The fixed releases address the memory‑management issue, so updating Apple devices to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 removes the flaw. Until then, a crafted app could trigger the use‑after‑free and crash the operating system or critical subsystem. The risk level is therefore moderate to high for systems that remain on earlier versions, especially where untrusted applications can be installed or where the OS is exposed to remote code execution vectors that could trigger the flaw. Even in the absence of public exploitation data, applying the updates is essential to prevent automated or targeted attacks.