The vulnerability is a bounds‑checking error that allows a malicious HID device to cause an unexpected process crash on affected Apple operating systems. This crash results in a denial of service, disrupting application stability and user experience. The flaw corresponds to input validation errors identified as CWE‑20.

Affected products include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The issue exists in iOS 18.7.4 and earlier, iPadOS 18.7.4 and earlier, macOS Sequoia 15.7.3 and earlier, macOS Sonoma 14.8.3 and earlier, macOS Tahoe 26.1 and earlier, tvOS 26.1 and earlier, visionOS 26.1 and earlier, and watchOS 26.1 and earlier. All versions up to the listed releases were patched in iOS 18.7.5, iPadOS 18.7.5, iOS 26.2, iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2.

The CVSS score of 5.7 indicates moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector, based on the description, is that an attacker must provide a crafted HID device to a vulnerable system. This could be achieved by physically connecting a malicious peripheral or through remote interfaces that accept HID input, but no evidence suggests a purely remote exploitation path. Given the limited exploitation likelihood, the overall risk remains moderate yet warrants timely patching.