Technical impact
Apple’s web content rendering components contain a buffer overflow flaw (CWE‑119) that can be triggered by maliciously crafted pages. The vulnerability is addressed with improved memory handling in current releases. If an affected device processes such content before upgrading, the process may crash unexpectedly, leading to a denial of service. The flaw does not grant code execution or data compromise, so the primary impact is service interruption for the application or browser.
Affected Systems
Apple iOS, iPadOS, macOS (codename Tahoe), tvOS, and watchOS are affected in all builds prior to the 26.5 release. Devices running any version older than iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, or watchOS 26.5 are susceptible; updating to the 26.5 update for each platform removes the faulty memory handling logic.
Risk and Exploitability
The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of large‑scale exploitation. The flaw can nevertheless be triggered remotely by serving maliciously crafted web pages or web‑view content to an affected device, resulting in a process crash and denial of service. Although the CVSS score of 7.5 classifies the issue as high severity, the limited exploitability moderates the overall risk.
