EUVD-2026-49439
GHSA-m326-x84x-2rw2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on target device
-
ExploitApp triggers use-after-free in kernel
-
ImpactUnexpected system termination occurs
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | An attacker must be able to get an app installed and executed on the target device; no special configuration, elevated privileges, or network access is needed. The vulnerability is triggered by normal app execution, making it local-only and reliant on social engineering or sideloading to deliver the malicious app. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is inconsistent with the description, which states only local denial-of-service triggered by an app. In reality, the attack vector is local (AV:L), impact is availability-only (A:H), and there is no evidence of confidentiality or integrity loss. EPSS score is 0.17% (6th percentile), indicating very low exploitation likelihood. CISA KEV does not list this vulnerability, and SSVC shows exploitation=none, though automatable=yes and technical impact=total (likely based on inflated CVSS). The real risk is low; this is a high-CVSS-but-low-real-risk issue, not a priority remote code execution threat. |
| Exploit ScenarioDerived | A user installs a malicious app on an unpatched device. When the app executes, it triggers the use-after-free condition in the kernel, causing an immediate system crash or panic, resulting in a denial of service. No user interaction beyond launching the app is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
RemediationAI
Apply vendor patches: update to iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No workarounds are provided; device owners should enable automatic updates. The advisory URLs from Apple confirm these fixed versions. If immediate patching is not possible, restrict app installation to trusted sources to mitigate the risk of a malicious app exploiting this local-only vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in an unspecified kernel or system component, addressed by improved memory management. A use-after-free occurs when a program continues to use a pointer after the memory it points to has been freed, leading to potential memory corruption or system instability. Affected products, identified by CPE, include Apple's iOS and iPadOS, macOS, tvOS, visionOS, and watchOS operating systems across multiple major versions.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local app execution, no privileges; only availability impact from system termination
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB