The vulnerability arises from insufficient bounds checks that allow a malicious HID device to trigger an unexpected crash in a running process. The weakness corresponds to CWE‑119, a buffer overrun condition, and the principal impact is denial of service rather than arbitrary code execution.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS are affected. Vulnerable versions include iOS and iPadOS 18.7.5 and all releases up to 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.2, as well as tvOS, visionOS, and watchOS 26.2. The flaw can be exploited by attaching a malicious human‑interface device to the affected device.

The CVSS score of 5.7 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known high‑profile exploits yet. Attackers would need physical access or control of a HID peripheral, making it a localized threat that can cause process crashes but not remote code execution. The risk level therefore remains moderate, centered on service availability disruptions in environments with untrusted peripherals.