This vulnerability is caused by an out-of-bounds read in Apple operating system components. The bug was fixed by adding improved bounds checking. An application that triggers the flaw can read memory beyond its bounds, which can cause the operating system or a service to crash. The only confirmed impact is a denial-of-service scenario; there is no indication that the flaw leads to data disclosure or arbitrary code execution.

Apple’s iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. All versions released prior to 26.5 contain the flaw. Apple has released a patch in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5 that addresses the issue.

The CVSS score of 7.5 indicates a high impact on availability, and the EPSS score of less than 1% suggests a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely local: a user must install or run a malicious or compromised application that triggers the out-of‑bounds read. If exploited, the attacker can force a crash, resulting in a denial of service on the affected device. Because the flaw does not enable privilege escalation or data leakage, the overall risk is moderate, but the impact on availability is significant for systems that rely on continuous operation.