A double free memory management bug was identified, allowing an app to trigger unexpected system termination. The vulnerability involves deallocating a memory region twice, which can corrupt the heap or crash critical system components. The impact is a denial of service that results in device instability or forced reboot, potentially disrupting user activity and services.

Apple’s iOS 26.7 and later, iPadOS 26.7 and later, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain the fix. Devices running earlier releases are vulnerable.

The exploit requires an application that can exercise the double free, so an attacker would need to supply a malicious or compromised app to the device. The CVSS score of 5.5 indicates moderate severity, and the EPSS score of 0.0016 (<1%) and the lack of a KEV listing suggest limited public exploitation data. However, the nature of the bug implies a potential for local exploitation on the affected operating systems. The risk is significant to availability, though not to confidentiality or integrity.