`BUG IN CLIENT OF LIBMALLOC: memory corruption of free block` crash at `AbstractCombineLatest.request(_:) ()`

Hello! I am running into a crash at AbstractCombineLatest.request(_:) (), BUG IN CLIENT OF LIBMALLOC: memory corruption of free block. The crash is Crashed: com.apple.NSURLSession-delegate EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x0000000000000000, or Crashed: com.apple.NSURLSession-delegate EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x446d4644951e0518

This has only been reported in production, for a small percentage of users. It has been present in our application for a while, but has become much more prevalent in the past few weeks, coinciding with the iOS 18.5 release.

The crash occurs when sending a value fetched from a network to a CurrentValueSubject, which is done on a Timer. A skeleton of the timer creation function:

    private func newTimer(for url: URL) {
        timerCancellable?.cancel()
        timerCancellable = Timer
            .publish(every: interval, on: .current, in: .common)
            .autoconnect()
            .flatMap({ [weak self] _ -> AnyPublisher<Response?, Never> in
                guard let self = self else {
                    return Just(nil).eraseToAnyPublisher()
                }
                return self.fetch(from: url)
            })
            .sink(receiveValue: { response in
                self.subject.send(response) // Crash occurs here
            })
    }

and the network request:

   private func fetch(from url: URL) -> AnyPublisher<Response?, Never> {
        return session
            .dataTaskPublisher(for: url)
            .map { (data, response) in
                let response = try? JSONDecoder().decode(Response.self, from: data)
                return response
            }
            .replaceError(with: nil)
            .eraseToAnyPublisher()
    }

Timer creation itself is triggered by a separate publisher:

  otherPublisher
            .map({ item  in
                guard let url = item?.url else {
                    self.timerCancellable?.cancel()
                    return nil
                }
                self.newTimer(for: url)
                return url
            })
                ...

Our crash reporting system has indicated the majority of these occur in the background, so I am curious if something could have changed in iOS 18.5 with background execution? Our app is registered with the audio background mode.