Technical impact
The vulnerability is a buffer overflow that results from insufficient bounds checking, classified as CWE-121. A remote attacker can trigger an unexpected system crash by sending crafted input to the vulnerable component. The failure does not provide direct privilege escalation, but it causes the operating system to terminate, leading to a denial of service.
Affected Systems
Apple macOS systems running versions earlier than macOS Sequoia 15.7.7 or macOS Tahoe 26.5 are susceptible. The issue has been fixed in those newer releases.
Risk and Exploitability
The vulnerability has a CVSS score of 7.5, indicating high severity. Exploitation requires remote delivery of malicious input, as implied by the description. Because the EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, it may not yet see widespread use, but the severe impact of a system crash makes it a high‑priority concern. The likely attack vector involves network‑based delivery or any remote interface that processes external data.
