The vulnerability originates from improper memory handling in Apple’s operating systems. An attacker able to send crafted data over the local network can trigger a fault that leads to a denial‑of‑service, bringing affected devices to a state where they become unresponsive or require a restart. The weakness involves CWE-400, representing uncontrolled resource consumption.

The flaw impacts iOS and iPadOS, macOS, and tvOS. On iOS and iPadOS the affected versions are those prior to 18.7.9 and 26.5, on macOS the Sonoma 14.8.7 and Tahoe 26.5 families, and on tvOS versions before 26.5. Devices running newer releases incorporate the patch that corrects the memory handling issue.

The CVSS score is 6.2, indicating moderate severity. The EPSS score is <1%, indicating a low but nonzero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalogue, suggesting that public exploitation has not been recorded. However, because the attack vector is local network activity, a threat actor positioned on the same network as the device can potentially induce the denial‑of‑service. The absence of a publicly available exploit does not reduce the risk to organizations that host exposed Apple devices.