A null pointer dereference vulnerability was identified that could allow an attacker to crash Apple operating systems, resulting in a denial‑of‑service condition for the affected device. The flaw arises when input validation fails, permitting a privileged network user to trigger the faulty code path. This weakness is classified as CWE‑476 – Incorrect Null Dereference. Once triggered, the operating system becomes unresponsive, affecting the availability of all services on the compromised device.

Apple devices running iOS 18.7.7 or 26.4, iPadOS 18.7.7 or 26.4, macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4, as well as tvOS 26.4, visionOS 26.4, and watchOS 26.4 are impacted. All platforms receive a patch that addresses the null pointer dereference through improved input validation.

The vulnerability has a CVSS score of 5.9, indicating a moderate risk, and an EPSS score of less than 1 %, suggesting few predicted exploit attempts. It does not appear in the CISA KEV catalog. Based on the description, the likely attack vector is a privileged network user sending crafted input to the device, which can cause the OS to crash. The exploit requires local or network access and does not provide escalation beyond service interruption.