The vulnerability originates from inadequate memory handling when rendering web content, which can lead to an unexpected process crash if malicious data is processed. These crashes disrupt normal operation and effectively deny service to the affected device or application.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are impacted. Versions before 26.5 are vulnerable; the flaw is resolved starting in iOS 26.5, iPadOS 26.5, macOS 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

The flaw does not grant code execution or data exfiltration. The attack vector is inferred to be through a web browser or any component that processes web content, requiring the target to load malicious data. No public exploitation has been reported, EPSS < 1%, and the vulnerability is not listed in CISA KEV. The CVSS score of 6.5 indicates moderate severity, and the risk level is moderate because of the lack of exploitation evidence and the absence of a clear attack path beyond the need to render malicious content.