The issue is an out‑of‑bounds write triggered when the operating system parses a maliciously crafted file. This causes an unexpected application termination, effectively denying service to that app. The flaw is a buffer overrun, identified as CWE‑787. The denial of service occurs locally and no remote code execution is disclosed.

Affected Apple platforms include iOS and iPadOS versions prior to iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, and macOS Sequoia older than 15.7.7, macOS Sonoma older than 14.8.7, and macOS Tahoe older than 26.5. The problem appears only before these specific patch releases.

Because the EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, the public exploitation probability is unclear, but the nature of the flaw suggests it could be triggered by an attacker who can place a crafted file on the device. The lack of evidence of remote exploitation and the requirement to parse a file indicate a local attack vector. The CVSS score of 7.3 indicates a high severity, and the impact of a denial of service may be significant for applications that must remain available.