This vulnerability is a use-after-free flaw (CWE-416) in Apple iOS and iPadOS that could allow a malicious app to cause unexpected system termination, potentially leading to denial of service or other impacts. Apple fixed the issue by improving memory management in iOS 26.6 and iPadOS 26.6, as well as in macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker controlling a malicious app could exploit this use-after-free vulnerability to cause unexpected system termination, resulting in denial of service and potentially compromising system stability and security. The vulnerability affects confidentiality, integrity, and availability at a high level according to the CVSS score.

A fix is available in iOS 26.6 and iPadOS 26.6, as well as corresponding 26.6 versions of macOS Tahoe, tvOS, visionOS, and watchOS. Users and administrators should update affected Apple operating systems to version 26.6 or later to remediate this vulnerability. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.