EUVD-2026-15042
GHSA-qmpr-r5h7-6c7x
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While specific CVSS and EPSS scores are not provided, this vulnerability carries notable real-world risk due to its broad platform impact and denial-of-service capability. The vulnerability affects Apple's entire ecosystem simultaneously, indicating a fundamental flaw in shared code. The attack vector appears to be application-based (an app can trigger the crash), suggesting moderate complexity. The denial-of-service impact is clearly defined as unexpected system termination. The lack of publicly documented active exploitation or proof-of-concept code limits immediate exploitation risk, but the breadth of affected devices (hundreds of millions worldwide) makes this a significant patch priority. The availability of multiple security advisories (references 126346-126796) indicates Apple treated this as a critical cross-platform issue requiring coordinated patching. |
| Exploit ScenarioDerived | A malicious or compromised application installed on an iOS device, Mac, Apple Watch, or other affected platform could trigger the use-after-free vulnerability through specific memory access patterns, causing the system to immediately crash and reboot. This could be weaponized in supply chain attacks (trojanized apps in App Store) or through social engineering to deliver a malicious app. While the attack requires local app execution and cannot directly escalate privileges, repeated crashes could serve as a denial-of-service vector against critical systems relying on continuous uptime, such as medical monitoring devices running watchOS or enterprise systems using Macs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Denial of service in Apple iOS, iPadOS, and macOS due to a use-after-free memory corruption vulnerability allows local attackers to trigger unexpected system termination. The flaw affects multiple Apple platforms including iOS 18.x, macOS Sequoia, Sonoma, and Tahoe versions. No patch is currently available.
Earlier versions of this analysis (1)
A use-after-free memory management vulnerability affects multiple Apple platforms including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker or malicious application can exploit this vulnerability to cause unexpected system termination (denial of service) by triggering memory management flaws. The vulnerability has been patched across all affected platforms with multiple security updates available through Apple's support bulletins.
RemediationAI
Immediately update all affected Apple devices to the patched versions: iOS and iPadOS to 18.7.7 or 26.3, macOS Sequoia to 15.7.5 (or Sonoma to 14.8.5 or Tahoe to 26.3), tvOS to 26.3, visionOS to 26.3, and watchOS to 26.3. Enable automatic security updates on all devices to receive future patches promptly. For organizations managing Apple fleets, deploy these updates through Mobile Device Management (MDM) solutions immediately given the broad cross-platform impact. Until patching is complete, monitor system logs for unexpected application crashes or system restarts as indicators of exploitation attempts. Restrict installation of untrusted applications from third-party sources, as the vulnerability requires app-level execution to trigger the use-after-free condition.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as a use-after-free issue (CWE-related memory safety defect) affecting Apple's core system libraries across their unified ecosystem. The affected products span multiple operating systems as identified by CPE strings: iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados), macOS (cpe:2.3:a:apple:macos), tvOS (cpe:2.3:a:apple:tvos), visionOS (cpe:2.3:a:apple:visionos), and watchOS (cpe:2.3:a:apple:watchos). Use-after-free vulnerabilities occur when a program references memory that has already been deallocated, potentially allowing execution of arbitrary code or system crashes. Apple addressed this through improved memory management techniques, suggesting the issue existed in shared kernel or framework code affecting all platforms simultaneously.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An app may be able to cause unexpected system termination.
Executive ViewAI
Organizations using A use after free should be aware of moderate risk from CVE-2026-20637, a use-after-free vulnerability rated CVSS 6.2. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB