The vulnerability arises from an input validation flaw that allows an application to provide malicious code to the operating system kernel. When exploited, the attacker can execute arbitrary code with kernel privileges, potentially enabling full system compromise. This weakness aligns with CWE‑94: Improper Control of Generation of Code.

Affected Apple operating systems include iOS 18.3 and later, iPadOS 18.3 and later, iPadOS 17.7.4, macOS Sequoia 15.3 and later, macOS Sonoma 14.7.3 and later, tvOS 18.3 and later, visionOS 2.3 and later, and watchOS 11.3 and later. All releases prior to these versions are vulnerable.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low exploitation probability under current threat landscape. The vulnerability is not listed in the CISA KEV catalog. The flaw can be leveraged through a local attack vector, where a malicious application is executed on the device, reaching the kernel via the flawed validation logic. If successful, the attacker would gain unrestricted access to the device, with full read/write/control over data and services.