EUVD-2026-29271
GHSA-5vrc-4fj4-9cmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryApp invokes vulnerable system API
-
ExploitTrigger use-after-free in memory management
-
ExecutionAccess freed memory region
-
PersistRead sensitive data from memory
-
ImpactSystem termination or crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | CRITICAL CONFLICT IN DATA: The description states exploitation requires 'an app may be able to cause unexpected system termination,' indicating the attacker must successfully install and execute an application on the target device. This is a significant prerequisite limiting exploitation to scenarios where users install malicious apps from outside Apple's App Store, or where legitimate apps are compromised. However, the CVSS vector AV:N/AC:L/PR:N/UI:N claims network-based remote exploitation with no user interaction and no authentication, which directly contradicts the app-based attack requirement. If the description is accurate, exploitation requires: (1) user installs attacker-controlled application, (2) application must execute on vulnerable OS version, (3) application must trigger specific API calls or conditions that invoke the vulnerable memory management code path. The CVSS vector suggests no special conditions for remote unauthenticated exploitation against default configurations, which is inconsistent. Authentication requirements not confirmed from available data due to this conflict. This discrepancy indicates either CVSS miscalculation or incomplete vulnerability description. |
| Impact | CRITICAL DATA CONFLICT DETECTED: The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-based remote unauthenticated exploitation, but the description explicitly states 'An app may be able to cause unexpected system termination,' which implies local application-level attack requiring app installation (should be AV:L). This discrepancy must be resolved with vendor clarification before accurate risk assessment. If CVSS is correct, this represents remotely exploitable memory corruption accessible without authentication. However, the impact score shows C:H/I:N/A:N (high confidentiality, no integrity or availability impact), which contradicts the description's 'unexpected system termination' (clearly an availability impact, should be A:H not A:N). EPSS exploitation probability of 0.02% (7th percentile) indicates extremely low real-world exploitation observed despite the theoretical severity. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis. The combination of unclear attack vector, contradictory impact classification, and very low EPSS suggests this may be a theoretical vulnerability with significant exploitation barriers not captured in the CVSS score. Priority should be MEDIUM for patch deployment pending vendor clarification of actual attack surface, unless systems are exposed to untrusted app installation or network services. |
| Exploit ScenarioDerived | An attacker develops or distributes a malicious application that triggers the use-after-free condition during normal operation or through crafted input to system APIs. When the vulnerable memory management code executes, the application exploits the dangling pointer to read sensitive memory contents from other processes or the kernel, potentially exposing cryptographic keys, authentication tokens, or personal data. The unexpected system termination mentioned in the description could serve as a denial-of-service attack vector or a side effect of failed exploitation attempts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 12, 2026
Use-after-free memory corruption in Apple operating systems allows high confidentiality impact through unexpected system termination. Affects iOS/iPadOS versions before 18.7.9 and 26.5, macOS Sequoia before 15.7.7, macOS Sonoma before 14.8.7, macOS Tahoe before 26.5, tvOS before 26.5, visionOS before 26.5, and watchOS before 26.5. Vendor-released patches are available across all affected platforms. EPSS score of 0.02% (7th percentile) indicates low observed exploitation probability in the wild, and no public exploit identified at time of analysis. CVSS vector indicates network-reachable attack surface with no authentication required, though the description states only 'an app' can trigger the condition, suggesting conflicting attack vector classification.
RemediationAI
Apply vendor-released security updates immediately: upgrade iOS and iPadOS to version 18.7.9 or 26.5 (depending on device compatibility), macOS Sequoia to 15.7.7, macOS Sonoma to 14.8.7, macOS Tahoe to 26.5, tvOS to 26.5, visionOS to 26.5, and watchOS to 26.5. Patches are available through standard Apple software update mechanisms (Settings > General > Software Update on iOS/iPadOS, System Settings > General > Software Update on macOS). Detailed security content information is available at https://support.apple.com/en-us/127110 through 127120. If immediate patching is not possible, restrict installation of untrusted applications to minimize attack surface until updates can be deployed, though this mitigation may not be effective if the network attack vector in the CVSS assessment is accurate. Organizations using Mobile Device Management should prioritize pushing these updates to managed devices. No known workarounds exist that fully mitigate use-after-free memory corruption vulnerabilities without applying the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability involves a use-after-free condition (CWE-416), a memory safety issue where code attempts to access memory after it has been freed. In Apple's ecosystem, this typically occurs in core system frameworks or libraries shared across iOS, macOS, tvOS, visionOS, and watchOS. The CPE data confirms the vulnerability spans all major Apple operating systems, suggesting the flaw exists in a common component or framework used across these platforms. Use-after-free vulnerabilities arise from improper object lifecycle management, often in reference-counted memory systems like Objective-C's ARC or manual retain/release patterns. The simultaneous patching across iOS versions 18.x and 26.x (likely representing different major releases) indicates the vulnerable code has existed across multiple OS generations. Apple's fix involves improved memory management, which typically means adding proper object lifetime tracking, implementing defensive null checks, or restructuring code to avoid dangling pointers.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.
Executive ViewAI
CVE-2026-28969 is a high-severity use-after-free vulnerability affecting Apple's ecosystem (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) that could allow unauthenticated network-based attackers to crash systems and potentially access sensitive data. With patches available across all affected platforms and no confirmed active exploitation, this represents a manageable risk requiring coordinated deployment across your organization's Apple device fleet.
Apply vendor patch. Until patching complete: restrict network access to affected devices from untrusted networks, disable network-facing services where possible, and monitor for unexpected system crashes or memory-related errors that could indicate exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB