A buffer overflow was discovered in several Apple operating systems, caused by insufficient bounds checking. The flaw allows a remote attacker to trigger unexpected application termination, resulting in a denial‑of‑service condition for the affected app. The weakness is a classic stack-based buffer overflow as identified by CWE‑121.

Apple’s iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are impacted. The fix is included in iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5; any earlier releases lack the patch.

The publicly available CVE information states that a remote attacker could cause application termination, but it does not detail the specific input or path used to trigger the stack overflow. It is therefore inferred that the attack vector involves the delivery of malformed data over the network. The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1 % and absence from the CISA KEV list suggest a low likelihood of widespread exploitation at present. The impact remains a loss of availability for the compromised application, without elevation of privileges or code execution.