A flaw in input validation can cause the operating system to crash, leading to a denial‑of‑service. The deficiency is believed to allow an attacker with a privileged network position to send crafted data that triggers the crash, causing the device to become unresponsive until restarted. No higher‑level privileges or code execution are required, so the impact is limited to loss of availability for the affected device.

Apple iOS and iPadOS devices running software versions earlier than iOS 18.7.7 or 26.4 and iPadOS 18.7.7 or 26.4 are affected. This includes all releases prior to those fixes.

The CVSS score of 4.9 indicates moderate severity; the EPSS score of < 1% indicates a very low probability of exploitation. The CVE is not listed in the CISA KEV catalog. Attackers require a privileged network position to deliver the malicious input, suggesting that the threat is primarily relevant to environments where devices are exposed to internal or custom networks rather than the general internet.