EUVD-2026-49608
GHSA-5qvw-29h6-3wc9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires local app execution and user interaction, total kernel impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.
AnalysisAI
Kernel memory corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to cause system termination or corrupt kernel memory. A use-after-free issue in the kernel’s memory management could be triggered by an app, leading to unexpected system behavior or potential code execution. Patches are available across all affected operating systems; no active exploitation has been observed.
Technical ContextAI
The vulnerability is a use-after-free (CWE-416) in the kernel’s memory management subsystem. Apple’s XNU kernel, shared across iOS, macOS, and other platforms, fails to properly handle dynamically allocated memory, allowing an application to reference freed memory. This can corrupt kernel state, leading to denial of service or arbitrary code execution within the kernel context. The affected products span all recent versions of Apple’s operating systems prior to the fixes.
RemediationAI
Apply the vendor-released updates: iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. No workarounds are available; the only mitigation is to limit app installation to trusted sources and promptly update. Advisory references are listed for each platform.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today