A buffer overflow that can be triggered remotely by writing data beyond the intended bounds, leading to unmanaged memory corruption. The flaw can crash the operating system, resulting in a denial‑of‑service. It is classified as CWE‑120, a buffer copy without proper bounds checks. The key consequence is that any affected device would become unusable until reboot or patch, impacting availability.

Apple iOS and iPadOS devices running versions prior to 26.4 are affected. The vulnerability is fixed in iOS 26.4 and iPadOS 26.4. Devices with later or updated firmware are not vulnerable.

With a CVSS score of 7.5 the severity is high, while the EPSS score is below 1 % indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is remote and can lead to a critical denial‑of‑service, any device running the affected OS should be patched as soon as possible. The exploit path requires a remote trigger; specific details are not provided but the attack vector is inferred to be remote based on the description.