EUVD-2026-49553
GHSA-82wv-p6cm-6c52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitInvoke vulnerable system API
-
ExecutionTrigger use-after-free (CWE-416)
-
ImpactCause unexpected system termination
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to get code running as an app on the target device (local execution) running iOS/iPadOS, macOS Tahoe, tvOS, or watchOS below version 26.6. There is no remote attack surface described - 'an app may be able to cause unexpected system termination' implies a locally installed/executed application. Limiting factors: victim must install or run the malicious app (App Store review, sandboxing, and notarization raise the bar), the target must be on an unpatched pre-26.6 OS, and the demonstrated impact is only a crash/reboot (availability), not data disclosure, modification, or code execution. |
| Impact | Signals conflict sharply. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, score 9.8) claims a remote, unauthenticated, full-triad compromise - but Apple's own description ('An app may be able to cause unexpected system termination') describes a locally-installed malicious app producing a crash, i.e. availability-only DoS with no confidentiality or integrity impact. The 9.8 is therefore grossly overstated: the realistic vector is local (AV:L) with A:H only. Corroborating this, EPSS is very low (0.16%, 6th percentile), CISA SSVC records Exploitation: none, and there is no KEV listing and no public exploit - 'no public exploit identified at time of analysis.' SSVC's 'Automatable: yes / Technical Impact: total' is consistent with a reliably triggerable crash rather than remote code execution. Net: despite the 9.8 headline, this is a low-real-risk local DoS on patched-in-26.6 Apple platforms, not a network-exploitable emergency. Verify impact scope with Apple - the CVSS confidentiality/integrity metrics are not supported by the description. |
| Exploit ScenarioDerived | A user installs or is tricked into running a malicious or buggy app on an iPhone, iPad, Mac, Apple TV, or Apple Watch running an OS older than 26.6. The app triggers a use-after-free in a system component, causing unexpected system termination (a crash/reboot). No public exploit code exists and there is no evidence of active exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
RemediationAI
Vendor-released patch: iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6 - apply these updates on every affected device; the four Apple advisories at https://support.apple.com/en-us/128066, https://support.apple.com/en-us/128067, https://support.apple.com/en-us/128068, and https://support.apple.com/en-us/128069 give the per-platform details. There is no meaningful server-side workaround because the flaw is triggered by locally executing application code, so compensating controls must narrow the app-execution surface until updates are deployed: enforce managed/allow-listed app installation via MDM and configuration profiles (trade-off: legitimate third-party apps outside the catalogue become unavailable), keep App Store review and notarization requirements enforced and disable sideloading/developer-mode on managed fleets where policy permits (trade-off: impedes internal development and Enterprise-signed distribution), and, on macOS, restrict non-notarized binary execution with Gatekeeper and hardened-runtime policies (trade-off: may break legacy in-house tooling unless individually allow-listed). Rapid update enforcement is the only control that removes the defect itself; the mitigations above merely reduce the likelihood that a hostile app reaches the vulnerable code path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use after free, a memory-safety defect class in which an object is released and its memory reclaimed while a dangling pointer to it is still dereferenced - typically leading to memory corruption, type confusion, or an immediate fault. Apple's advisory language, "addressed with improved memory management," indicates the fix hardens object lifetime handling (retain/release or reference-counting semantics) in a shared framework rather than adding an input filter. Because iOS/iPadOS, macOS Tahoe, tvOS, and watchOS are built on the common Darwin/XNU foundation and share large portions of their user-space frameworks, the same defect manifests across all four products; the CPE data enumerates exactly these platforms with wildcard version ranges (cpe:2.3:a:apple:ios_and_ipados, apple:macos, apple:tvos, apple:watchos, all version ranges ending at 26.6). Notably, the initial published CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is inconsistent with the vendor description of an app-triggered crash; the independent assessment re-scores this as AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, i.e. a local, unauthenticated (no privileges required), no-user-interaction availability-only issue. Under that assessment the defect is a sandboxed denial-of-service primitive, not a remote code-execution vector, and the impact ceiling is a process or system crash.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
A locally running app triggers the flaw (AV:L, PR:N/UI:N as any app suffices); impact is only unexpected termination so A:H with C:N/I:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Executive ViewAI
Apple device fleets running iOS/iPadOS, macOS Tahoe, tvOS, and watchOS below version 26.6 are exposed to a memory-corruption flaw that can crash or unexpectedly restart a device, but only when an attacker-supplied application is already installed and executed locally. The practical exposure is therefore limited to availability on devices where users can install untrusted apps, and no data disclosure, modification, or code execution has been demonstrated; no public exploit has been identified at time of analysis, and the headline CVSS 9.8 network rating materially overstates the real reachability of this bug. Leadership should treat this as a routine, well-understood patching obligation rather than an emergency, while confirming that application-install controls on managed devices remain effective.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB