Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
AnalysisAI
We need to produce a JSON analysis. We have CVE-2026-43814. Description: use after free in Apple's operating systems (iOS, iPadOS, macOS, tvOS, watchOS), fixed in versions 26.6. CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-416 use after free. EPSS 0.16%, low. No KEV mention, so not in KEV. Tags: Denial of Service, Apple, etc. But description says "app may be able to cause unexpected system termination" -> that's a crash/DoS. The CVSS suggests network, no privs, high impact on CIA. That seems contradictory: a network attack causing system termination by an app? It might be that the vulnerability is in some system component that an app can trigger, and the app could be network-facing? Or maybe CVSS is wrong. Let's synthesize.
We must produce product_name: 1-3 words: "iOS and iPadOS" ... but includes multiple. Affected products: many. Primary product? I'd say "Apple OS Family" not appropriate? The description says "iOS and iPadOS", "macOS", "tvOS", "watchOS". I'll pick the most prominent: "iOS and iPadOS" or "Apple OS" but we need 1-3 words. "iOS and iPadOS" is 3 words. That works, includes the primary. Or "Apple Operating Systems" but that's generic. I'll use "iOS and iPadOS" since it's first listed and likely the most used. But the vulnerability spans all. I'll go with "Apple OS Family"? That's 3 words: Apple OS Family. I think product_name: "Apple OS Family" (or "Apple iOS/macOS"). The instruction says "If multiple products, pick the primary one." The primary might be iOS. So "iOS". But then the summary might need to clarify. I'll pick "iOS" as the most common, and mention others. In product_name, "iOS" is 1 word. That might simplify. I'll go with "iOS" but technically the vulnerability is in iOS, iPadOS, macOS, tvOS, watchOS. So I'll put "iOS and iPadOS" as two-word phrase? Actually three words. I'll put "iOS" as primary, but that's reductive. Let's think: The CPEs are separate: cpe:2.3:a:apple:ios_and_ipados:*:*, etc. The NVD often groups them
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-49553
GHSA-82wv-p6cm-6c52