A malicious Human‑Interface Device can trigger an unexpected crash of an application or process due to insufficient bounds checking, which the vendor has addressed with improved bound checks; based on the description, it is inferred that the original checks were inadequate. The flaw can cause a denial of service by terminating or destabilizing software components. The vulnerability represents a classic input validation weakness (CWE‑400) that can be exploited by supplying crafted HID input to an otherwise untrusted interface.

Apple clients running iOS 18.7.5 or later, iPadOS 18.7.5 or later, macOS Sequoia 15.7.4 or later, macOS Sonoma 14.8.4 or later, macOS Tahoe 26.2 or later, tvOS 26.2, visionOS 26.2, and watchOS 26.2 are covered by the fix. The issue is tied to the operating systems listed, and no specific application or device subset is singled out beyond the distinct Apple platforms.

The CVSS score of 5.7 indicates moderate risk. EPSS shows less than 1 % probability, suggesting low likelihood of exploitation in the wild. The flaw is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker physically connecting a malicious HID to the target device or remote manipulation of an already connected HID device. No additional conditions are reported, so the vulnerability appears independent of user privileges and observable through normal device operation.