Technical impact
The flaw is an out‑of‑bounds read that occurs in Apple operating system components; improved bounds checking has been added in the listed releases. An application that triggers the bug can read memory beyond its intended bounds, leading to a crash of the operating system or a specific service. The confirmed impact is a denial of service; there is no indication that the vulnerability leads to data disclosure or arbitrary code execution.
Affected Systems
Apple’s iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. All versions released prior to 26.5 contain the flaw. Apple has released a patch in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5 that addresses the issue.
Risk and Exploitability
The CVSS score of 7.5 indicates a high impact on availability, and the EPSS score of less than 1% suggests a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely local: a user must install or run a malicious or compromised application that triggers the out-of‑bounds read. If exploited, the attacker can force a crash, resulting in a denial of service on the affected device. Because the flaw does not enable privilege escalation or data leakage, the overall risk is moderate, but the impact on availability is significant for systems that rely on continuous operation.
