The vulnerability arises from insufficient input validation when a device processes web content that has been deliberately malformed, a weakness identified as CWE-20 (Improper Input Validation). If triggered, the device’s process terminates unexpectedly, interrupting normal operation. This leads to a denial of service rather than code execution or data leakage.

Affected devices include Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The fix is delivered in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

The CVSS score of 4.3, EPSS score of <1%, and the absence from CISA's KEV list indicate a moderate severity and low exploitation probability. The issue requires processing of maliciously crafted web content, which suggests the attack vector involves either local access to such content or exposure through a web service on the device. While the vulnerability does not provide code execution, it can cause repeated crashes, creating a significant availability risk especially for services relying on uninterrupted web content processing. Since exploitation requires the presence of the malformed content, the likelihood of attack remains moderate but the impact on affected systems is high for denial of service scenarios.