Technical impact
A type confusion bug was corrected in Apple software. The flaw allowed an attacker that can communicate over the local network to trigger an unexpected termination of applications running on iOS, iPadOS, macOS, tvOS, or visionOS. The failure occurs when the system incorrectly interprets an object’s type, leading to a crash. The result is a denial of service that can disrupt user workflows without compromising data confidentiality or integrity.
Affected Systems
Affected systems include Apple iOS, iPadOS, macOS, tvOS, and visionOS. On iOS 18.4 and newer, the issue is addressed; the same applies to iPadOS 18.4 and iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, and visionOS 2.4.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate impact. The EPSS score below 1% suggests that exploitation is unlikely in current landscape, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires local network presence; an attacker would need to send malicious payload to an application listening on the network. Such exploitation would result in a crash but does not allow privilege escalation or code execution. The best posture is to ensure devices stay updated.
EUVD