An untrusted HID device can trigger an improper bounds check within the operating system's input handling, causing a process to crash unexpectedly. The vulnerability is classified as a memory corruption flaw (CWE‑119) and results in a denial‑of‑service condition for the affected process. This crash can be used by an attacker with physical access to disrupt critical applications or system services.

Apple’s iOS and iPadOS platforms up to version 18.7.5 and 26.2, macOS Sequoia up to 15.7.4, macOS Sonoma up to 14.8.4, and macOS Tahoe up to 26.2, as well as tvOS, visionOS, and watchOS versions up to 26.2 are impacted. The targeted devices include iPhones, iPads, Mac computers, Apple TVs, visionOS devices, and Apple Watches.

The CVSS score of 5.7 indicates a moderate impact, and the EPSS score of less than 1 % shows that exploitation is unlikely in the current environment. The vulnerability is not listed in the CISA KEV catalog, further suggesting that it is not actively exploited. The attack vector is most likely local, requiring a malicious HID device to be connected to the target device, which means physical access or a compromised peripheral is needed. Given these constraints, the overall risk remains relatively low but still warrants timely patching to avoid potential disruption.