A type confusion issue exists in several Apple operating systems where the system can be tricked into interpreting an object as a different type before improved checks are applied. This flaw, as described, allows a remote attacker to trigger a crash that terminates processes or entire operating system instances, effectively denying service to the affected device. The vulnerability is a classic example of improper type validation and incorrect type conversion, reflected in the relevant CWE identifier CWE-843.

Affected Apple platforms include iOS on iPhone and iPad, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The specific fixed releases are iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. All hardware running any of these operating systems is potentially impacted until the patched versions are installed.

With a CVSS score of 7.5 and no disclosed exploit in the wild, the vulnerability is not listed in CISA’s KEV catalog, indicating a low to moderate risk of exploitation. The EPSS score of < 1% indicates a very low probability of exploitation, but a remote attacker capable of triggering the type confusion could still cause a denial of service on the target device. Until patched, devices remain vulnerable to an attacker capable of sending crafted payloads to induce the flaw.