An out‑of‑bounds read can be triggered by a mobile or desktop application, causing the operating system to crash and exhibit a denial‑of‑service. The flaw is a classic bounds‑checking error, classified as CWE‑125. The official description does not indicate that it exposes confidential data or allows code execution; it only states that an app may be able to cause a crash.

Apple’s iOS 18.7.2, iPadOS 18.7.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1 contain the fix. Devices running earlier releases are presumed to be vulnerable because the description does not list any other mitigated versions; the vulnerability applies to any hardware running those operating system versions.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. Based on the description that an application can trigger a crash, it is inferred that the vulnerability can only be exploited from within an application, implying a local denial‑of‑service vector. The issue is not listed in the CISA KEV catalog.