EUVD-2026-49447
GHSA-347f-3cff-8gh8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious app to device
-
DeliveryApp triggers vulnerable framework path
-
ExploitUse-after-free dereferences freed memory
-
ExecutionCorrupt memory state
-
ImpactUnexpected system termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a malicious application to be installed and executed on the target Apple device - the description states 'an app may be able to cause unexpected system termination,' so the concrete prerequisite is attacker-controlled code running locally as an app, not remote network access. Limiting factors: the attacker must first get the app onto the device and executed (which on iOS/iPadOS/tvOS/watchOS/visionOS is constrained by App Store review and sandboxing, and on macOS by Gatekeeper/notarization), and the demonstrated impact is system termination (DoS) rather than confirmed code execution. This directly contradicts the CVSS AV:N/PR:N/UI:N rating - the description implies local app execution, so verify the network-vector claim with Apple. |
| Impact | Signals conflict and should be weighed carefully. The NVD CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) implies remote unauthenticated full compromise, but Apple's description explicitly limits impact to 'an app may be able to cause unexpected system termination' - i.e. a local app causing a crash (availability only), so the 9.8 network/RCE rating appears inflated and should be verified against the vendor advisory. EPSS is low (0.17%, 6th percentile) and SSVC records Exploitation: none, consistent with no public exploit identified at time of analysis; however SSVC also flags Automatable: yes and Technical Impact: total. Net real-world priority is moderate: patch as part of normal Apple update cadence, but this reads as a local DoS rather than a wormable RCE, and the KEV list does not include it. Verify the discrepancy between CVSS network vector and the local, DoS-only description with Apple before treating it as critical RCE. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized app; when run, the app exercises the vulnerable framework path and triggers the use-after-free, causing the device or system to terminate unexpectedly (a denial-of-service crash). No public exploit code is identified at time of analysis, and the crash impact makes this more of a reliability/DoS threat than a data-compromise vector unless the memory corruption proves further exploitable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
RemediationAI
Apply the vendor-released patches: upgrade to iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, visionOS 26.6, and watchOS 26.6, which contain the improved memory-management fix. Consult the matching Apple security notes at https://support.apple.com/en-us/128066 through /128072 to map each note to your platform. Because exploitation requires a locally installed app, the primary compensating control until patching is restricting app installation to trusted/vetted sources (App Store / MDM-approved apps) and removing untrusted apps; on managed fleets, enforce MDM allow-listing - the trade-off is reduced user flexibility in installing arbitrary software.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416): code continues to reference a memory region after it has been freed, allowing a dangling pointer to be dereferenced and corrupt process/kernel state, which Apple resolved 'with improved memory management.' Per the CPE data the flaw spans Apple's shared codebase across cpe:2.3:a:apple:ios_and_ipados, :macos, :tvos, :visionos and :watchos, indicating the vulnerable component is common framework/OS code reused across all Apple operating systems rather than a single product. The manifestation - an installed app triggering the condition - points to an app-reachable system service or kernel/framework interface whose object lifecycle is mishandled.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires a locally installed/run app (AV:L, UI:R to install/launch); impact is only unexpected termination, so C:N/I:N/A:H, contradicting the NVD network C/I/A:H rating.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Executive ViewAI
A critical denial-of-service vulnerability affects Apple's entire ecosystem (iOS, iPadOS, macOS, tvOS, visionOS, watchOS), allowing locally-installed malicious applications to crash devices and disrupt operations across corporate and user-owned systems. The broad device footprint and system-level impact create significant operational risk; however, vendor patches are available and exploitability remains low (0.2% EPSS). Immediate patch deployment across managed devices and user communication for BYOD systems is required to mitigate widespread disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB