EUVD-2026-49499
GHSA-pm9m-mp3j-hf4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious app to device
-
ExploitApp triggers use-after-free (CWE-416)
-
ExecutionFreed memory reused during operation
-
ImpactUnexpected system termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to get a malicious app running on the target Apple device (iOS/iPadOS/macOS Tahoe/tvOS/watchOS prior to 26.6); per Apple, 'an app may be able to cause unexpected system termination,' so local code execution as an installed app is the prerequisite rather than remote network access. Exploitation is limited by the need to deliver and launch that app (sideload, enterprise/MDM install, or Store review bypass), by iOS/macOS app sandboxing and code-signing controls, and by the fact that the observed impact is a crash/DoS rather than data theft. Patched by updating all affected OSes to version 26.6. |
| Impact | The signals here strongly conflict and the input CVSS 9.8 is grossly inflated relative to the actual impact. The NVD/vendor vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, but Apple's own description ('An app may be able to cause unexpected system termination') describes a locally-installed malicious app causing a crash - i.e., a local (AV:L) denial-of-service, NOT a network-reachable RCE with confidentiality/integrity loss. The AV:N and C:H/I:H are not supported by the description and should be verified against Apple's advisory; the honest impact is availability-only. Corroborating this: EPSS is very low (0.16%, 6th percentile), SSVC lists Exploitation=none, and there is no CISA KEV listing and no public exploit. SSVC's 'Automatable: yes' and 'Technical Impact: total' push priority up, but 'total' here reflects the vendor's inflated C/I/A rather than the real DoS-only outcome. Net: no public exploit identified at time of analysis; this is a patch-in-normal-cycle issue (a local app-triggered crash on Apple platforms), not a high-urgency remotely-exploitable emergency despite the 9.8 headline number. |
| Exploit ScenarioDerived | An attacker distributes a malicious or trojanized app (e.g., via sideloading, enterprise provisioning, or a Store submission) that, once run on the victim's device, triggers the use-after-free and forces an unexpected system termination/crash. No public proof-of-concept or active exploitation is known; realistically this is a reliability/DoS impact rather than code execution based on the vendor description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.
RemediationAI
Vendor-released patch: upgrade to iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, which resolve CVE-2026-28928 via Apple's improved memory management fix; see the Apple advisories at https://support.apple.com/en-us/128066 through https://support.apple.com/en-us/128067/128068/128069 for per-platform instructions. Because exploitation requires local app execution, the practical interim mitigations are reducing the attack surface for untrusted code until devices are updated: keep sideloading restricted and enforce MDM/enterprise app-allowlisting so arbitrary unsigned apps cannot be installed (trade-off: blocks legitimate ad-hoc internal apps), maintain strict code-signing and notarization enforcement on macOS so unsigned binaries cannot run (trade-off: may break developer workflows and legacy tooling), and remove or pause any unvetted apps already installed on high-value devices (trade-off: none, but requires inventory visibility). Note that these controls reduce the likelihood of a malicious app being present rather than fixing the underlying memory-safety defect, so patching remains the only complete remedy; there is no public exploit code circulating, so emergency out-of-band deployment is not warranted for most environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416), a memory-safety class in which the affected Apple system component frees a heap object and then continues to dereference it, allowing an attacker who controls the contents of that reclaimed memory to corrupt program state. Apple's advisory describes the fix as 'addressed with improved memory management,' which is Apple's standard phrasing for adding or tightening reference counting/lifetime handling in the vulnerable framework. The CPE strings (apple:ios_and_ipados, apple:macos, apple:tvos, apple:watchos - all '*' versions below 26.6) confirm the flaw is shared across Apple's OS family rather than being limited to a single app or service, consistent with a common system library used by all four platforms. Exploitation requires getting a malicious app onto the target device and executing it; it is not remotely reachable over the network as the raw NVD vector implies, and the observed consequence is a crash/termination rather than memory disclosure or code execution.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
A locally-running app triggers the crash, so AV:L and PR:N (any app); impact is unexpected system termination only, so A:H with C:N/I:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Executive ViewAI
Apple has released fixes for a memory-corruption flaw affecting iOS, iPadOS, macOS Tahoe, tvOS, and watchOS that can crash an affected device when it runs a malicious or malformed app. The exposure is limited to availability - a device can be forced to terminate or restart - and no public exploit code or active exploitation has been identified, so this is a fleet-hygiene issue rather than an active threat to the business. Leadership should care because the remediation touches nearly every Apple endpoint and mobile device in the organization, and unpatched devices remain a reliability and eventual risk-management concern.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB