The vulnerability results from an insufficient bounds check when processing input from HID devices. A malicious HID device could trigger an unexpected process crash, creating a denial‑of‑service condition that affects the stability and availability of the affected services or applications. This weakness is classified as CWE‑119, a classic buffer overflow or out‑of‑bounds access issue.

Apple releases list the flaw in iOS 18.7.5 and iOS 26.2, iPadOS 18.7.5 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2. All of the named operating systems and versions are impacted.

The CVSS score of 5.7 indicates a moderate severity level. The EPSS score of less than 1% shows that exploit attempts are very unlikely at present. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits are documented. Because the flaw is triggered by a malicious HID device, the most likely attack scenario involves physically attaching the device or otherwise controlling it before the update is applied.