Technical impact
In this vulnerability, an exploitable memory handling flaw in Apple operating systems allows maliciously crafted web content to trigger an unexpected process crash. The flaw has been remedied through enhanced memory handling in all Apple’s major platforms, and the fix has been released in version 26.5 for iOS, iPadOS, macOS Tahoe, visionOS, and Safari.
Affected Systems
The affected systems include all iOS, iPadOS, macOS, visionOS, and Safari browsers running a version earlier than 26.5.
Risk and Exploitability
The EPSS score of < 1% indicates a very low probability that this vulnerability is actively exploited in the wild, a conclusion inferred from the low EPSS value. Based on the stated CVSS score of 7.5, the flaw carries a moderate‑to‑high severity rating, implying that an attacker who can supply malicious web content to a vulnerable system may be able to cause a denial of service by crashing a process. This inference assumes the resource can be triggered remotely via web content. The vulnerability is not listed in CISA’s KEV catalog, signifying no known widespread exploitation. Organizations serving untrusted web traffic are advised to apply the 26.5 update promptly to eliminate the crash vector.
