Technical impact
A heap buffer overflow resulting from insufficient bounds checking was discovered in several Apple operating systems. The flaw allows an attacker to supply crafted data that can cause the affected system to terminate unexpectedly, effectively denying service to legitimate users. Because the vulnerability is a memory corruption bug (CWE‑122), it does not directly enable remote code execution, but the induced crash can disrupt system operation and uptime.
Affected Systems
Apple devices running iOS 26.7.2, iOS 27.2, iPadOS 26.7.2, iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, or watchOS 27.2 contain the vulnerable code and are therefore affected.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity condition, and the EPSS value of <1% shows a very low current exploitation probability. Although the vulnerability is not listed in the CISA KEV catalog, the description indicates that an attacker within radio range could trigger the overflow, implying a remote denial‑of‑service vector. If an attacker can establish proximity, they could cause repeated crashes, but the low EPSS suggests that widespread exploitation is unlikely at present.
