A buffer overflow was discovered in the input validation routine of Apple’s operating systems. The flaw permits a local user to trigger an unexpected system termination or to read data from kernel memory, exposing sensitive information that resides in kernel memory. The vulnerability is a stack‑based buffer overflow, classified as CWE‑121.

Affected Apple operating systems include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Specific vulnerable releases are iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. All newer releases beyond these are considered patched.

With a CVSS score of 6.2 the vulnerability is considered moderate. Exploitation requires local access; no network or privilege escalation is indicated. The EPSS score is less than 1%, and the issue is not listed in the CISA KEV catalog, implying a low probability of current exploitation. Unpatched devices that allow local user interaction carry a moderate risk, while those running the fixed OS releases have only a low residual risk.