Technical impact
A buffer overflow flaw was discovered in several Apple operating systems. The vulnerability arises from insufficient bounds checking, allowing an application to supply crafted data that overflows a buffer and causes the OS to terminate unexpectedly. The flaw is classified as CWE‑120 and results in a denial‑of‑service condition; it does not provide code execution or privilege escalation capabilities.
Affected Systems
Apple iOS and iPadOS versions prior to 18.7.9 or 26.5, macOS Sequoia older than 15.7.7, macOS Sonoma older than 14.8.7, macOS Tahoe before 26.5, and the corresponding earlier releases of tvOS, visionOS, and watchOS are affected. The issue was fixed in the OS updates listed in the description.
Risk and Exploitability
The CVSS score of 7.5 indicates a high‑severity denial‑of‑service vulnerability, yet the EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, suggesting a low likelihood of active exploitation. Based on the description, the likely attack vector is a malicious or improperly behaved application that supplies crafted input to the vulnerable component. No public exploits have been reported, so the current risk remains moderate until an exploit is discovered or the attack surface changes.
