The vulnerability is an improper memory handling flaw identified as CWE-400 in Apple operating systems. An attacker that can run a malicious application may trigger unexpected system termination or corrupt kernel memory, causing a denial-of-service. The potential for kernel memory corruption raises concerns for device stability and confidentiality, but privilege escalation is not explicitly confirmed.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS devices running any version prior to the 26.1 releases are affected. The flaw is fixed in iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1.

The CVSS score of 7.5 indicates high severity, yet the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, implying a low current exploitation likelihood. Nevertheless, because a malicious app can trigger the flaw, the attack vector is likely local or via malicious app distribution, and the risk remains moderate to high until patched. Organizations should treat this risk as significant and apply mitigations promptly.