EUVD-2026-15160Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents significant real-world risk despite the absence of published CVSS and EPSS scores. The attack vector is network-based and requires only that a user visit a malicious webpage, indicating low attack complexity and no privilege requirement. The denial-of-service impact is concrete and verified across multiple supported platforms. While the immediate technical impact is limited to process crashes rather than code execution, the ubiquity of affected products (spanning smartphones, tablets, desktops, wearables, and spatial computing devices) expands the overall attack surface. The fact that Apple has issued fixes across eight distinct security bulletins (126792-126799) suggests the issue warranted coordinated cross-platform patching. Without current KEV status confirmation or published POC information, the vulnerability appears to be in managed disclosure rather than active exploitation, but the web-based attack vector and lack of user interaction beyond normal browsing means exploitation could be swift if weaponized. |
| Exploit ScenarioDerived | An attacker hosts a webpage containing specially crafted web content that triggers the use-after-free condition in WebKit's memory management. When a victim visits this page using any affected Apple device (iPhone, iPad, Mac, Apple Watch, Apple TV, or Vision Pro), their browser or WebView processes the malicious content, causing a memory access violation that crashes the application. No user interaction beyond clicking a link or visiting a cached page is required, making this a practical denial-of-service vector particularly effective against critical services that rely on persistent browser-based access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS contain a use-after-free vulnerability that could allow remote attackers to crash affected applications by processing maliciously crafted web content. The vulnerability stems from improper memory management and requires user interaction to exploit. No patch is currently available, leaving users vulnerable until official updates are released.
Earlier versions of this analysis (1)
A use-after-free vulnerability in Apple's WebKit engine affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across multiple versions. An attacker can trigger a denial-of-service condition by crafting malicious web content that causes an unexpected process crash when processed. While CVSS and EPSS metrics are unavailable, the breadth of affected platforms and web-based attack vector indicate moderate to significant real-world risk.
RemediationAI
Immediately update to the patched versions: iOS/iPadOS 18.7.7 or 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. Consult Apple's security bulletins at https://support.apple.com/en-us/126792 through https://support.apple.com/en-us/126799 for platform-specific patch instructions. As a temporary mitigation, restrict web browsing to trusted sites only and disable JavaScript if the user can tolerate reduced functionality, though neither measure fully eliminates risk. For enterprise deployments, enforce Mobile Device Management (MDM) policies to mandate updates and consider deploying content filtering to restrict access to potentially malicious web sources until all endpoints are patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is a use-after-free memory safety issue within WebKit, Apple's rendering engine responsible for processing web content across all affected platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS). Use-after-free vulnerabilities (related to CWE-416) occur when code attempts to access memory that has already been freed, resulting in undefined behavior. The affected products span multiple CPU architectures and operating systems: iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), macOS variants including Sequoia, Sonoma, and Tahoe (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), tvOS (cpe:2.3:a:apple:tvos:*:*:*:*:*:*:*:*), visionOS (cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*), and watchOS (cpe:2.3:a:apple:watchos:*:*:*:*:*:*:*:*). The vulnerability is triggered during the processing of web content, suggesting the attack vector is network-based and requires no authentication.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
Executive ViewAI
Organizations using A use-after-free should be aware of notable risk from CVE-2026-28879, a use-after-free vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
GitHub PoC
Exploit-DB