The vulnerability permits an attacker with a privileged network position to send specially crafted Bluetooth packets that trigger a denial‑of‑service condition in Apple operating systems. If successfully exploited, the affected device may crash, halt services, or become entirely unresponsive, compromising availability. The weakness is a resource exhaustion flaw, identified as CWE‑400.

Apple’s iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The flaw exists in all builds prior to version 26.3 of each operating system, which includes every release before the 26.3 update that introduced improved packet validation.

The CVSS score of 7.5 places the issue in the high‑severity range. However, the EPSS score is less than 1 %, indicating a very low likelihood of exploitation in the wild at present. The flaw appears only in environments where an attacker can transmit Bluetooth traffic to the target device, typically meaning proximity or a compromised Bluetooth network. Because the vulnerability is not listed in the CISA KEV catalog, there is no known widespread exploitation, but the operational impact of a successful denial‑of‑service attack could still be significant for critical services.