The flaw stems from inadequate input validation when processing web content, allowing an attacker to craft content that causes the system to crash or become unresponsive. This issue is identified as CWE-400, denoting unchecked input that can lead to resource exhaustion or denial of service. The primary impact is that the OS or application designed to render the web content may terminate or hang, disrupting user activity and potentially preventing access to affected services.

Apple iOS and iPadOS devices are affected. Apple released mitigations in iOS 18.5, iPadOS 18.5, and iPadOS 17.7.7. Devices running earlier iOS or iPadOS releases remain vulnerable until these updates are applied.

The CVSS score of 6.5 places the vulnerability in the moderate category. With an EPSS score of less than 1 %, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog, further reducing immediate concern. The probable attack vector involves an attacker delivering malicious web content—for example, a web page or local HTML file—to the device’s web content renderer, which can trigger a crash or denial of service. No remote code execution, privilege escalation, or data exfiltration is indicated by the current description.