EUVD-2026-78002
GHSA-x72v-58hp-rp9g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitation needs a locally running app (AV:L, PR:L) with no user interaction and low complexity; impact is availability-only, matching the description.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to cause unexpected system termination.
AnalysisAI
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to install and run an application in the iOS/iPadOS app sandbox on a device running a version below iOS 27 (CVSS PR:L, AV:L) - no user interaction is needed once the app is executed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - a local, low-complexity, low-privilege availability-only issue with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update all iPhones and iPads to iOS 27 / iPadOS 27, which contains the memory-management fix for this use-after-free; this is the only complete remediation and there is no configuration-only workaround that removes the vulnerable code path, since the flaw is reachable from app context. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today