Description
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service.
Published: 2026-07-27
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free vulnerability in macOS memory management allows an application to access resources that have already been released. Triggering this fault can cause the operating system to crash, resulting in a denial‑of‑service condition. The weakness is formally classified as CWE‑416: Use After Free. The vulnerability can affect system stability, but it does not provide direct access to confidential data or system code.

Affected Systems

macOS releases prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 are impacted. Devices running these earlier versions may experience application or system crashes if exploited. Updating to the specified firmware releases removes the flaw.

Risk and Exploitability

The EPSS score is less than 1%, indicating a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, and no active exploitation has been reported. Attackers would need to target a vulnerable application that accesses freed memory. Because the flaw results in a crash rather than code execution, the threat is limited to a loss of availability and service interruption. The CVSS score of 9.8 reflects the severity of the resulting denial‑of‑service, but the overall exploit risk remains low due to the minimal exploitation probability.

Generated by OpenCVE AI on August 3, 2026 at 16:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade macOS to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 or later
  • Configure automatic system updates to ensure timely delivery of security patches
  • Monitor system event logs for repeated crashes following application actions that could trigger the use‑after‑free

Generated by OpenCVE AI on August 3, 2026 at 16:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Title Denial-of-Service Exploitation via Use-After-Free in macOS

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 28 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description A use after free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-07-28T14:12:37.724Z

Reserved: 2026-07-20T18:09:24.049Z

Link: CVE-2026-64703

cve-icon Vulnrichment

Updated: 2026-07-28T14:12:30.859Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T21:17:09.877

Modified: 2026-07-28T17:58:02.000

Link: CVE-2026-64703

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T16:45:03Z

Weaknesses