The vulnerability arises from a failure in input sanitization that allows an attacker to supply malformed data leading to unexpected system termination or kernel memory corruption. This flaw is a classic buffer overflow (CWE‑119) and could potentially destabilize the operating system or expose sensitive memory contents. The impact manifests as a denial of service, with the possible escalation to more severe kernel compromise if the attacker can control the corrupted memory region.

Apple products are affected across several lines of their operating system fleet. iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, and visionOS 2.5 contain the vulnerable code. The bug was patched in these versions; earlier releases remain at risk. The vulnerability spans mobile, desktop, and wearable devices running the respective OS versions.

The CVSS score of 8.2 marks this as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed large‑scale exploitation. The likely attack vector is through local or system‑level input, potentially via user‑controlled data that reaches the affected sanitization routine. Due to the absence of publicly disclosed exploits, organizations should treat this flaw as a high‑risk but low‑probability threat.