A stack overflow condition in several Apple operating systems originates from insufficient input validation, allowing applications to trigger a crash that ends processing of legitimate operations. The flaw results in a denial‑of‑service that affects the target device's stability but does not grant code execution or data exfiltration. This weakness is identified as a buffer overflow (CWE‑20).

Affected platforms include iOS and iPadOS on versions 18.7.7 and 26.4, macOS in the Sequoia 15.7.5 and Tahoe 26.4 releases, as well as tvOS, visionOS, and watchOS all on the 26.4 update. Devices running these builds are vulnerable until an update that implements the tightened input validation is installed.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of under 1% shows a very low probability that the flaw will be actively exploited. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed exploits in the wild. Attackers would need to supply crafted data to a vulnerable application or run a malicious app on the device; as such, the primary vector is application-level input, and no elevation of privilege is required. Once triggered, the device becomes unresponsive until reboot, impairing availability.