The vulnerability arises from inadequate authorization checks that let an application perform restricted actions, potentially exhausting system resources and making services unavailable. This results in a denial-of-service condition that a malicious or compromised app can trigger by executing in a normal user context. The weakness is characterized by improper authorization (CWE-284).

Apple’s iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected when running versions prior to the releases that contain the fix. The fix is included in iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Devices running earlier versions remain vulnerable.

With a CVSS score of 7.5, the flaw is judged medium‑to‑high severity. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Attackers would most likely deploy a compromised application that runs locally on the device; no remote network interaction is required to trigger the denial‑of‑service.