Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
AnalysisAI
We need to output a JSON object with the specified fields, synthesizing from the provided CVE data. The input includes: CVE ID, description, CVSS score 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-416, EPSS 0.17% (6th percentile), patch available, tags: Denial Of Service, Apple, etc., SSVC: exploitation none, automatable yes, technical impact total. CPE strings, references to Apple support pages, affected versions from EUVD. The description says: "A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination."
Important: The impact phrase says "An app may be able to cause unexpected system termination." That sounds like a denial of service, not code execution. However, the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which implies full confidentiality, integrity, availability impact. That seems contradictory because causing unexpected system termination would typically be A:H only, and perhaps C/I not impacted, or maybe the vulnerability is local (an app) and might require user interaction? The CVSS vector suggests network attack, no privileges, no user interaction, high impact on all three. That doesn't align with the description saying "An app may be able to cause unexpected system termination." The CVSS score might be from NVD or Apple, but the description suggests only a denial-of-service (system termination). Also tags include "Denial Of Service" but also "Memory Corruption", "Use After Free". Use-after-free can lead to code execution, but the description explicitly says "unexpected system termination". However, the CVSS vector implies total compromise. This discrepancy must be addressed in the analysis.
We need to produce a synthesis. The request: "Return a JSON object ... CRITICAL: Do NOT copy or paraphrase the Descriptio
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-49540
GHSA-jhhf-626g-pprq