A classic buffer overflow was reported, resulting from inadequate bounds checking. This flaw lets a remote user trigger unexpected system termination or corrupt kernel memory, a vulnerability classified as CWE‑120. The potential impact includes loss of availability and, if an attacker can successfully write to arbitrary kernel memory, a compromise of confidentiality and integrity on the affected device.

The defect affects Apple iOS and iPadOS devices running any release prior to version 26.4. Apple’s advisory indicates that iOS 26.4 and iPadOS 26.4 contain the fix, protecting devices that run those or later releases.

The CVSS score of 9.8 signals a critical severity. Although the EPSS indicates a probability of exploitation of less than 1 % and the vulnerability is not listed in the KEV catalog, the remote nature of the attack and the serious consequence of kernel memory corruption make the risk high. Based on the description, it is inferred that a remote attacker could deliver a crafted payload to trigger the overflow, potentially enabling further exploitation such as code execution.