What is the CVSS score of EUVD-2026-15042?

EUVD-2026-15042 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by EUVD-2026-15042?

Organizations using A use after free should be aware of moderate risk from CVE-2026-20637, a use-after-free vulnerability rated CVSS 6.2.. A patch is available.

How to fix or mitigate EUVD-2026-15042?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS EUVD-2026-15042

| CVE-2026-20637 MEDIUM

Use After Free (CWE-416)

2026-03-25 apple

GHSA-qmpr-r5h7-6c7x

Denial Of Service Use After Free Memory Corruption Apple iOS macOS

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.3,14.8.5,18.7.7

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15042

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 6.2

DescriptionCVE.org

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An app may be able to cause unexpected system termination.

AnalysisAI

Denial of service in Apple iOS, iPadOS, and macOS due to a use-after-free memory corruption vulnerability allows local attackers to trigger unexpected system termination. The flaw affects multiple Apple platforms including iOS 18.x, macOS Sequoia, Sonoma, and Tahoe versions. No patch is currently available.

Technical ContextAI

This vulnerability is classified as a use-after-free issue (CWE-related memory safety defect) affecting Apple's core system libraries across their unified ecosystem. The affected products span multiple operating systems as identified by CPE strings: iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados), macOS (cpe:2.3:a:apple:macos), tvOS (cpe:2.3:a:apple:tvos), visionOS (cpe:2.3:a:apple:visionos), and watchOS (cpe:2.3:a:apple:watchos). Use-after-free vulnerabilities occur when a program references memory that has already been deallocated, potentially allowing execution of arbitrary code or system crashes. Apple addressed this through improved memory management techniques, suggesting the issue existed in shared kernel or framework code affecting all platforms simultaneously.

RemediationAI

Immediately update all affected Apple devices to the patched versions: iOS and iPadOS to 18.7.7 or 26.3, macOS Sequoia to 15.7.5 (or Sonoma to 14.8.5 or Tahoe to 26.3), tvOS to 26.3, visionOS to 26.3, and watchOS to 26.3. Enable automatic security updates on all devices to receive future patches promptly. For organizations managing Apple fleets, deploy these updates through Mobile Device Management (MDM) solutions immediately given the broad cross-platform impact. Until patching is complete, monitor system logs for unexpected application crashes or system restarts as indicators of exploitation attempts. Restrict installation of untrusted applications from third-party sources, as the vulnerability requires app-level execution to trigger the use-after-free condition.