This vulnerability arises from a race condition in Apple iOS and iPadOS that could be exploited by a malicious app to cause unexpected system termination or to write kernel memory, potentially leading to privilege escalation or system compromise. Apple fixed the issue by improving state handling in iOS 26.6 and iPadOS 26.6, as well as in related Apple operating systems. The CVSS 3.1 base score of 9.8 reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker controlling a malicious app could exploit this race condition to cause the system to terminate unexpectedly or to write to kernel memory, which may lead to arbitrary code execution with kernel privileges, compromising system security and stability.

A fix is available and has been released by Apple in iOS 26.6 and iPadOS 26.6. Users and administrators should update affected devices to these versions or later to remediate this vulnerability. No additional mitigation guidance is provided or required beyond applying the official update.