Apple macOS suffers a denial‑of‑service flaw that arises from insufficient input validation, identified as CWE‑20. A remote attacker who can send crafted inputs to the vulnerable component can cause the targeted service or the operating system to crash, resulting in a loss of availability for the affected user or system. Based on the description, it is inferred that the attacker must send crafted inputs remotely to trigger the denial‑of‑service, as the attack vector is not explicitly described.

The issue affects Apple macOS versions prior to Sequoia 15.7.2, Sonoma 14.8.2, and Tahoe 26.1. All earlier macOS releases are vulnerable until an update that includes the fix is applied.

The vulnerability scores a CVSS of 7.5, indicating a high severity. Its EPSS score is less than 1 %, indicating a very low likelihood of exploitation, and it is not listed in CISA’s KEV catalog. The flaw can be triggered remotely by an attacker exploiting the improper input validation path. Overall risk remains moderate but a timely patch is recommended to eliminate the available attack surface.