The vulnerability is a use‑after‑free flaw in Apple’s operating‑system memory‑management code. When memory that has already been freed is accessed by an application, the system can crash, causing unexpected termination of the device. This results in a denial of service that disrupts availability but does not provide the attacker with code execution or data exposure. The weakness corresponds to CWE‑416.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS versions earlier than 26.6 are susceptible. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6 and watchOS 26.6.

The CVSS score of 9.8 indicates a high severity, and the EPSS score of less than 1% suggests a low current exploitation probability. Because the flaw requires a malicious or improperly signed application to exercise the vulnerable code path, the most likely attack vector is an app that a user installs or uses. The vulnerability is not listed in CISA’s KEV catalog. In environments that allow third‑party apps, the risk is moderate due to the need for user action, but the impact is limited strictly to service interruption rather than confidentiality or integrity compromise.