A flaw in bounds checking allows a malicious Human Interface Device to trigger an unexpected crash of an application or system process. The vulnerability does not provide immediate code execution or data disclosure but disrupts availability by terminating processes that receive crafted input from an external device.

Apple iOS and iPadOS devices should be updated to the fixed firmware releases (iOS 18.7.5, iOS 26.2, iPadOS 18.7.5, iPadOS 26.2). macOS systems need to be updated to Sequoia 15.7.4, Sonoma 14.8.4, Tahoe 26.2; tvOS, visionOS, and watchOS also require update to 26.2. The updated firmware versions include improved bounds checks that resolve the vulnerability.

With a CVSS score of 5.7, the problem is moderate in severity. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector requires physical connection of a malicious HID device; an attacker with access to the target device could supply crafted input to force a crash.