EUVD-2026-49608
GHSA-5qvw-29h6-3wc9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDevelop malicious app
-
DeliverySocial engineer user to install app
-
ExploitUser opens app
-
ExecutionApp triggers use-after-free in kernel
-
PersistKernel memory corruption
-
ImpactSystem termination or privilege escalation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local execution of a malicious app is required; the vulnerability is not remotely exploitable. No user interaction beyond launching the app is necessary, but the app must be installed and executed on the target device. No special configuration is required; all vulnerable version installations are susceptible. |
| Impact | The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) conflicts with the description, which clearly states exploitation requires a locally installed app - a local attack vector. The EPSS score of 0.17% (6th percentile) indicates very low predicted exploitation activity, corroborating the absence of known in-the-wild abuse. SSVC rates automatable: yes and technical impact: total, so compromise could be severe if exploited. Given that the vulnerability requires a malicious app to already be on the device, the practical risk is moderate; it is not remotely exploitable. The high CVSS score does not reflect real-world attack prerequisites, making this a priority for patching but not an emergency unless untrusted apps are common in the environment. |
| Exploit ScenarioDerived | An attacker creates a malicious app that triggers the use-after-free condition by manipulating kernel memory allocations. The app is distributed through social engineering or a compromised third-party store, and when the victim opens it, the exploit causes a kernel panic (system crash) or memory corruption that could lead to elevation of privileges. No public exploit code is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Kernel memory corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to cause system termination or corrupt kernel memory. A use-after-free issue in the kernel’s memory management could be triggered by an app, leading to unexpected system behavior or potential code execution. Patches are available across all affected operating systems; no active exploitation has been observed.
RemediationAI
Apply the vendor-released updates: iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. No workarounds are available; the only mitigation is to limit app installation to trusted sources and promptly update. Advisory references are listed for each platform.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in the kernel’s memory management subsystem. Apple’s XNU kernel, shared across iOS, macOS, and other platforms, fails to properly handle dynamically allocated memory, allowing an application to reference freed memory. This can corrupt kernel state, leading to denial of service or arbitrary code execution within the kernel context. The affected products span all recent versions of Apple’s operating systems prior to the fixes.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires local app execution and user interaction, total kernel impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB