This vulnerability arises from a race condition in Apple iOS and iPadOS that can be exploited by an app to cause unexpected system termination. Apple addressed the issue by improving state handling. The fix is included in iOS 26.6 and iPadOS 26.6, as well as macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

An attacker controlling a malicious app could exploit this race condition to cause unexpected system termination, potentially leading to denial of service and disruption of device availability. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

A fix is available in Apple operating system versions 26.6 for iOS, iPadOS, macOS Tahoe, tvOS, and watchOS. Users and administrators should update to these versions to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official update.