The vulnerability originates from a flaw in memory handling that causes an unexpected process crash when maliciously crafted web content is processed. This flaw can be triggered by content delivered through web browsers or embedded web views, leading to a denial‑of‑service condition for the affected application or the entire operating system. The impact is a temporary loss of service; there is no evidence of persistent or privileged execution.

Apple iOS, Apple iPadOS, Apple macOS, Apple tvOS, Apple visionOS, and Apple watchOS are affected. The fix is provided in iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly confirmed exploits at present. The likely attack vector is the delivery of malicious web content, which can be remote if executed within a web browser or local if used by a native application that renders web content. Without an exploit that turns the crash into code execution, the risk remains a denial‑of‑service threat, but timely patching eliminates the vulnerability.