EUVD-2026-78002
GHSA-x72v-58hp-rp9g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on unpatched device
-
DeliveryApp triggers use-after-free in system component
-
ExploitReused freed memory corrupts state
-
ExecutionSystem process crashes
-
ImpactUnexpected device termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to install and run an application in the iOS/iPadOS app sandbox on a device running a version below iOS 27 (CVSS PR:L, AV:L) - no user interaction is needed once the app is executed. There is no indication that authentication as a privileged user, jailbreak, kernel-level access, or a non-default configuration is required; the vulnerable path is reachable from ordinary app context, and the description does not mention any enabling feature or entitlement. Factors that limit real-world exploitation: the outcome is confined to availability (C:N/I:N/A:H), so an attacker gains no data access or code execution outside the sandbox; the flaw is fixed in iOS 27/iPadOS 27, so updated devices are not exposed; and EPSS is 0.17% with no KEV listing and no public exploit code, meaning no observed tooling. The main residual exposure is unmanaged or legacy devices that cannot upgrade to the iOS 27 train. |
| Impact | CVSS 3.1 scores this 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - a local, low-complexity, low-privilege availability-only issue with no user interaction. That vector is internally consistent with the description: the attacker needs the ability to run code as an app (PR:L) on the target device (AV:L), and the outcome is system termination with no data exposure. However, the real-world risk signals are weak: EPSS is 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis. The EUVD record (EUVD-2026-78002) mirrors NVD with an affected range of iOS/iPadOS 0 < 27. Note a genuine scoping consideration: PR:L for a mobile OS means any installed app, which is a very low bar on a consumer device, so the 'local' vector should not be read as requiring physical access or jailbreak. Conversely, SSVC-style exploitation status is 'none' and automatable is limited, so the practical priority is routine patch-cycle remediation, not emergency response. No conflicting data was found between sources; the only gap is that neither Apple nor NVD names the specific vulnerable component. |
| Exploit ScenarioDerived | A user installs a malicious or compromised application on an unpatched iPhone or iPad running any version below iOS 27. When the app executes a crafted operation that frees and then reuses a memory object in the affected system component, the corrupted state crashes the system and the device terminates or reboots unexpectedly. Because the vector is AV:L/AC:L/PR:L/UI:N, the attacker only needs the app to be running on the device - no user interaction beyond installation - but the result is availability impact only, making this a nuisance-class or targeted-disruption technique rather than a data-theft primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
RemediationAI
Update all iPhones and iPads to iOS 27 / iPadOS 27, which contains the memory-management fix for this use-after-free; this is the only complete remediation and there is no configuration-only workaround that removes the vulnerable code path, since the flaw is reachable from app context. Because exploitation requires a locally installed app, the practical compensating controls are to limit the attack surface on devices that cannot be updated immediately: enforce managed-app allowlisting and disable sideloading/enterprise side-load profiles via MDM, restrict app installation to the App Store or a vetted internal catalog, remove untrusted or abandoned applications, and monitor for repeated unexpected device terminations or reboots as a possible symptom. The trade-off of allowlisting is administrative overhead and reduced user flexibility, and it is a mitigation rather than a fix - it does not eliminate the bug if a malicious or compromised allowlisted app triggers it. Reference the Apple advisory at https://support.apple.com/en-us/149034 for the authoritative release mapping, and re-check for a security update backport if you operate hardware that cannot run iOS 27.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, Use After Free: a memory object is released but later dereferenced, and the fix is described as 'improved memory management,' which in Apple's terminology usually means added lifetime tracking, reference-counting corrections, or object-lifetime validation in a system component reachable from app context. The affected CPE is the version-wildcard entry cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, meaning every release before the iOS 27 / iPadOS 27 train is in scope - Apple does not enumerate the specific kernel extension, system daemon, or framework that contains the defect in the advisory. Because the description says 'an app may be able to cause unexpected system termination,' the vulnerable code is reachable from the app sandbox but the corruption manifests in a system-level process, which is why the impact is availability-only (A:H) with no confidentiality or integrity effect.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitation needs a locally running app (AV:L, PR:L) with no user interaction and low complexity; impact is availability-only, matching the description.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB