Apple Operating Systems EUVD-2026-104735

Exploitation requires an attacker to already be able to execute code as an app on the target Apple device (AV:L, PR:L) - there is no remote or network-reachable path and no user interaction beyond running the malicious app (UI:N). The app invokes the specific vulnerable system code path that double-frees memory; the resulting impact is limited strictly to availability (unexpected system termination / crash), with no confidentiality or integrity consequences. Key limiting factors: it is a local-only DoS, so it cannot be triggered remotely, cannot escalate privileges or leak data per the CVSS metrics, and is mitigated entirely by updating to the fixed OS versions listed by Apple.

This is a moderate-severity, availability-only issue that does not rise to an urgent patching priority despite affecting ubiquitous Apple platforms. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: a malicious or compromised app already running on the device (AV:L, PR:L) triggers a double free (CWE-415) that causes unexpected system termination - a denial of service with no confidentiality or integrity impact (C:N/I:N, A:H). CISA's SSVC framework reinforces the low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. This CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one clearly conflicting signal is metadata, not scoring: the 'Information Disclosure' tag contradicts the CVSS (C:N) and the description (system termination), which describe a pure availability/DoS condition - the tag should not be used to classify this as a disclosure issue. Net assessment: genuine but low-to-moderate priority; the local-app precondition and DoS-only impact mean it is a reliability/hardening fix rather than a critical remote-compromise vector.

A user installs or is tricked into running a malicious app on an iPhone, iPad, Mac, Apple TV, Apple Watch, or Vision Pro device. The app invokes the vulnerable system code path in a way that triggers the double free, corrupting memory and causing the device or affected service to terminate unexpectedly. No public proof-of-concept is referenced, and the impact is limited to denial of service rather than code execution or data theft.