Technical impact
The vulnerability is a resource exhaustion flaw that occurs because of insufficient input validation. When exploited, a remote attacker can cause a device to become unresponsive or crash, effectively denying availability. The flaw is aggravated by the system’s inability to limit the resources consumed by malformed or overly large inputs, leading to denial of service.
Affected Systems
Apple iOS and iPadOS devices running versions older than iOS 18.7.9, iOS 26.4, iPadOS 18.7.9 or iPadOS 26.4 are affected. These systems are vulnerable to the resource exhaustion issue until patched.
Risk and Exploitability
Based on the description, it is inferred that local privileges are not required; a remote attacker who can reach the vulnerable component may trigger the exception. The CVSS score of 7.5 indicates a high severity, while the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA KEV, indicating that widespread exploitation has not yet been observed. Nevertheless, a remote adversary could send crafted input to initiate a denial of service.
