The flaw is a double free error in Apple’s operating systems that can be triggered by a remote attacker, causing an unexpected application termination. The vulnerability stems from improper memory deallocation where a free operation is performed twice, leading to corrupted internal memory structures. While it does not allow code execution or data theft, the denial of service can degrade user experience and affect application stability.

Apple product families including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. Versions iOS 18.5, iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, and watchOS 11.5 contain the unpatched bug.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, a remote attacker could potentially trigger the vulnerability by interacting with a vulnerable application over a remote channel, leading to application crashes. The overall risk is moderate but mitigable through patching.