A flaw in Apple’s operating systems around input validation allows a non‑privileged user to cause a denial‑of‑service crash and modify restricted network settings, affecting device availability and potentially allowing traffic redirection. Apple’s iOS 18.6, iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6 have been patched; all earlier releases remain vulnerable. The CVSS score of 7.5 classifies it as high severity, yet the EPSS score below 1% indicates unlikely exploitation today. The flaw is not in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to be present on the device or run an application that can supply crafted input; an attacker can crash the device or alter network configurations and, when the system restarts, restore connectivity or redirect traffic.

Apple’s iOS 18.6, iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6 have been patched; all older releases remain vulnerable.

The CVSS score of 7.5 classifies it as high severity, yet the EPSS score below 1% indicates unlikely exploitation today. The flaw is not in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to be present on the device or run an application that can supply crafted input; an attacker can crash the device or alter network configurations and, when the system restarts, restore connectivity or redirect traffic.