An out‑of‑bounds read occurs when an application accesses memory beyond its allowed bounds, allowing an attacker to trigger a crash. The flaw is mitigated in macOS Tahoe 26 through improved bounds checking, but on older systems it can cause unexpected system termination. The weakness is CWE‑125 and does not provide remote code execution; its primary impact is denial of service as the operating system or running services may become unavailable.

Apple macOS releases older than macOS Tahoe 26 are affected. The vulnerability is resolved in macOS Tahoe 26 and later, so any macOS version before that remains vulnerable.

The CVSS score of 3.3 indicates low severity, and the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Since the flaw requires triggering an out‑of‑bounds read inside the operating system, it is most likely exploitable by a local or privileged application, meaning an attacker needs local execution or the ability to run a malicious app on the target machine. If such code runs, the resulting crash could deny service to legitimate users.