An out‑of‑bounds write in system input validation code allows a malicious application to corrupt kernel memory, potentially leading to crash or arbitrary code execution. The flaw is a classic buffer overflow vulnerability (CWE‑787). The impact ranges from unexpected system termination to privileged code execution on the affected device.

Apple operating systems Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected, with the flaw fixed in the following releases: iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Devices running earlier versions than these releases remain vulnerable.

Based on the description, the likely attack vector is an application that runs in user space and exploits the flaw to write kernel memory; this can occur from a malicious or compromised third‑party app. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.5 indicates medium severity, yet the memory corruption nature suggests a strong potential for exploitation. No public exploits are known at the time of this analysis, but the oversight in kernel memory handling warrants proactive mitigation.