Technical impact
A memory corruption vulnerability in Apple operating systems can cause applications to terminate unexpectedly, resulting in a denial of service for the affected software. This vulnerability is identified as a race condition (CWE-362). The likely attack vector is through unsynchronised concurrent access to shared resources, which an attacker could trigger with crafted input. The CVE description does not disclose a direct code execution path, so the primary consequence remains application instability rather than full system compromise.
Affected Systems
Apple’s iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. Versions prior to iOS 18.7.9, iOS 26.5, iPadOS 18.7.9, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5 are vulnerable; these releases are mitigated by the corresponding patched versions or newer.
Risk and Exploitability
The EPSS score is <1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 4.7 reflects a moderate severity, largely due to local denial of service through application termination without providing privilege escalation or remote code execution. Apple’s fix resolves the root cause through enhanced locking mechanisms, eliminating the undesired application termination.
