EUVD-2026-49540
GHSA-jhhf-626g-pprq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker publishes/sideloads malicious app
-
DeliveryUser runs app on device
-
ExploitApp triggers use-after-free in OS component
-
ExecutionFreed memory reused
-
ImpactUnexpected system termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker's code to run as an app on the affected device (iOS/iPadOS <26.6, macOS Sequoia <15.7.8, macOS Sonoma <14.8.8, macOS Tahoe <26.6, tvOS/visionOS/watchOS <26.6) - i.e. the malicious or buggy app must already be installed and executed locally, per Apple's phrasing 'An app may be able to cause unexpected system termination.' Limiting factors: Apple's app sandbox and App Store/notarization vetting constrain delivery of a malicious app; the demonstrated impact is confined to crashing the system (denial of service) with no evidence of code execution or data disclosure. Not a remote-unauthenticated flaw despite the input CVSS AV:N. |
| Impact | Real-world risk is far lower than the headline CVSS 9.8 suggests. The supplied vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is inconsistent with Apple's own description: 'An app may be able to cause unexpected system termination' describes a locally-installed app triggering a use-after-free that crashes the system - this is a local vector (AV:L), and the only demonstrated impact is availability (a crash), not confidentiality or integrity. The C:H/I:H claims are not supported by the description, which stops at 'unexpected system termination' with no mention of code execution or data disclosure. Corroborating low-risk signals dominate: EPSS is 0.17% (6th percentile), SSVC exploitation status is 'none', and there is no CISA KEV listing and no public exploit. SSVC does flag Automatable:yes and Technical Impact:total, but 'total' conflicts with the DoS-only reading and likely reflects the inflated CVSS rather than an independent read. Bottom line: this is a high-CVSS-but-low-real-risk denial-of-service bug, patchable via routine OS update; prioritize normal patch cadence, not emergency response. Note the AV:N-vs-local-app discrepancy should be verified against Apple's advisory. |
| Exploit ScenarioDerived | A user installs or runs a malicious or malformed app on an affected Apple device; the app exercises the vulnerable code path and triggers a use-after-free, causing the operating system to terminate unexpectedly (a crash/reboot). No public exploit code has been identified, and the practical outcome is denial of service on the local device rather than data theft or remote takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
RemediationAI
Vendor-released patches are available: upgrade iOS and iPadOS to 26.6, macOS Sequoia to 15.7.8, macOS Sonoma to 14.8.8, macOS Tahoe to 26.6, and tvOS, visionOS and watchOS to 26.6, applying the corresponding Apple security notes at https://support.apple.com/en-us/128066 through https://support.apple.com/en-us/128070 and https://support.apple.com/en-us/148287 (with 128071/128072 covering the remaining platform notes). Because the flaw requires a local app to trigger, compensating controls before patching should focus on the app-delivery path: enforce App Store/notarization and MDM app allowlisting so that only vetted, signed applications execute; the trade-off is reduced ability to run in-house or sideloaded software and ongoing maintenance of allowlists. On managed fleets, disable sideloading/developer-mode installs and restrict enterprise-signed app distribution, accepting the loss of ad-hoc internal tooling flexibility. There is no configuration toggle that removes the vulnerable memory-management path itself, so these controls only reduce the likelihood of a malicious app being present and should be treated as temporary until devices reach the fixed versions above. Patching requires a reboot on iOS/iPadOS/macOS and a watch/tv/headset update cycle, so stage rollouts to avoid user disruption.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (use after free), a memory-safety class in which a process frees an object and then dereferences the stale pointer, allowing corrupted heap state and typically a crash or, in some cases, attacker-controlled memory reuse. Apple addressed the defect through improved memory management, indicating it was a ref-counting or lifetime bug in a shared system component reachable from an app's sandboxed context. CPE data confirms the affected platform set as cpe:2.3:a:apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos and apple:watchos, all wildcarded across versions below their respective 26.6 / 15.7.8 / 14.8.8 fix releases. The multiple advisory references (support.apple.com 128066-128072 and 148287) correspond to per-platform security notes covering the same patch wave. Critically, the NVD-style vector (AV:N/PR:N/UI:N, C:H/I:H/A:H) conflicts with the independent assessment (AV:L/PR:N/UI:N/C:N/I:N/A:H): reachability requires local code execution inside the app sandbox, and the demonstrated outcome is availability loss only - system termination - with no confirmed path to code execution, privilege escalation, or data disclosure. Apple's phrasing, 'An app may be able to cause unexpected system termination,' corroborates the local, availability-only characterization.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
A locally-running app triggers the UAF (AV:L, PR:N/UI:N as no extra privilege is stated); impact is limited to system crash, so C:N/I:N/A:H.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Executive ViewAI
A critical-rated memory corruption flaw affects Apple's iOS/iPadOS, macOS (Sequoia, Sonoma, Tahoe), tvOS, visionOS, and watchOS platforms, but its real-world reach is narrow: it requires a malicious or compromised app already running on the device, and the resulting impact is limited to that app crashing or the device restarting unexpectedly. Because exploitation demands local code execution and no public exploit code or active exploitation has been identified, the practical risk to our environment is lower than the 9.8 headline score suggests, though fleet-wide patching across every Apple OS we support will consume IT effort. Leadership should care mainly about device availability and the operational cost of a broad, multi-platform update cycle rather than a credible external attack path.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB