External risk intelligence

Apple iOS and iPadOS Double Free Memory Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-84561

This vulnerability affects local operating systems on consumer devices (iOS, iPadOS, macOS, tvOS, visionOS, watchOS). These are client-side endpoints, not internet-facing services, gateways, or public-facing servers. Exploitation requires execution on the local device, making public internet exposure in the context of an edge service or public-facing application inapplicable.

Apple Ipados

before 26.715.0 to before 15.826.0 to before 26.7before 27.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory management issue in Apple operating systems could allow an application to cause unexpected system termination or corrupt kernel memory. This vulnerability has been addressed in recent software updates across various Apple platforms, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The main concern is confirming relevance and exposure to this specific type of system-level vulnerability.

Software flaw could crash devices or corrupt memory.
Understand potential system instability and data corruption.
Confirm relevance and exposure to this software issue.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a device, potentially through a malicious app or web content, that triggers a flaw in how the system manages memory. This could lead to unexpected behavior, such as crashing the system or corrupting critical memory data.

No special access required.
Triggered by memory management flaw.
Risk of system crash or memory corruption.

Live Threat

Current exploitation, exposure, and threat context

A double free vulnerability could allow an app to trigger unexpected system shutdowns or corrupt kernel memory. This could potentially impact the stability and integrity of the operating system on affected Apple devices when the conditions are met.

System stability and kernel memory.
Malicious app could corrupt memory.
Unexpected system termination.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability impacts Apple's operating systems, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Owners of these devices and the applications running on them should initiate an inventory of all affected systems. The immediate priority is to confirm which systems are exposed to potential threats and identify the accountable teams responsible for patching or updating. Once identified, a phased remediation plan based on the criticality of the affected assets should be developed and executed.

Ownership: Device and application owners.
Verify: System exposure and business criticality.
Action: Plan and execute updates or patches.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-84561?

This CVE impacts the core operating systems powering Apple hardware, including iOS and iPadOS for mobile devices, macOS for computers, plus tvOS, visionOS, and watchOS for specialized hardware. These platforms provide the essential framework that manages device resources, runs applications, and handles communication between software and hardware components.

How should I understand the double free vulnerability in CVE-2026-84561?

The flaw is a double free, categorized as CWE-415. It occurs when a program attempts to release the same memory location twice, leading to memory management errors. This can cause the system to crash unexpectedly or, more critically, corrupt kernel memory, which is the most sensitive area of the operating system that controls hardware and process execution.

What triggers this memory corruption issue?

The vulnerability is triggered when an application or piece of malicious web content submits a specially crafted request that forces the system into an invalid memory state. Importantly, simply running an app under normal conditions does not trigger this; it requires specific, malicious input designed to exploit how the operating system handles the lifecycle of allocated memory.

Do I need to worry about this if I use Apple devices?

Halo Surface Signal notes that while this is a critical vulnerability, it primarily affects local consumer endpoints rather than public-facing internet servers. You should prioritize assessment if your devices handle sensitive data, as the threat arises from malicious local code execution rather than direct remote network access to a gateway.

When should I take action for CVE-2026-84561?

You should act immediately by identifying which devices in your environment are running older, unsupported versions of these operating systems. The primary defense is applying the vendor-provided software updates, as they contain the necessary patches to correct the memory management logic and prevent this specific type of kernel-level corruption.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.