A flaw in input validation can cause an application to crash, resulting in a denial‑of‑service condition. The weakness is a classic input validation flaw (CWE‑20) that allows an attacker to supply malformed data that the system does not handle correctly. An impacted application that receives the malformed data can be forced to terminate, rendering either the app or the underlying system unresponsive until a restart or recovery action occurs.

Apple’s operating systems are affected. The vulnerability applies to iOS and iPadOS running any version prior to 18.7, and to macOS versions prior to Sequoia 15.7, Sonoma 14.8, and Tahoe 26. Each of these platforms includes the operating system itself and any applications that rely on the affected system components.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score shows an exploitation probability of less than 1 percent, suggesting that the vulnerability is not widely leveraged in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is application‑level; a malicious app or specially crafted payload can trigger the crash. Because the flaw is limited to proper validation of input, an attacker does not gain code execution or elevated privileges; the primary impact is service disruption.