A memory corruption flaw identified as a buffer overflow (CWE‑120) allows a malicious application to overwrite kernel memory. The improper handling of memory can trigger unexpected system termination or enable the attacker to write arbitrary data to the kernel, potentially destabilizing the device or granting elevated privileges. The issue was corrected in Apple’s later OS releases, but devices running earlier versions remain vulnerable.

Apple products – iOS, iPadOS, macOS (Sequoia 15.7.2, Sonoma 14.8.2, Tahoe 26.1), tvOS 26.1, visionOS 26.1, and watchOS 26.1 – are affected, with the vulnerability present in all versions prior to those listed.

The CVSS score of 5.5 places the flaw in the medium range, and the EPSS score of less than 1 % indicates a low probability of exploitation. Nonetheless, the vulnerability is listed in the CISA KEV catalog, reflecting confirmed exploitation in the wild. The attack most likely requires a malicious application installed on the device; no remote or network‑based vector is documented, so the threat is limited to local exploitation scenarios.