Technical impact
An out‑of‑bounds write bug was fixed with improved bounds checking in Apple operating systems. The flaw allows a local attacker on a shared network to trigger a denial‑of‑service condition, potentially causing the device or affected application to crash or become unresponsive. The impact is limited to the device’s availability and does not expose user data or enable further compromise.
Affected Systems
Apple iOS versions 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5 are affected. All affected systems are exposed to local network traffic when the bug is exploitable.
Risk and Exploitability
The EPSS score is < 1% and the CVSS score is 6.2; the vulnerability is not listed in the CISA KEV catalog. The low EPSS indicates a very low probability of exploitation, but the local denial of service remains a concern in environments where devices are accessible over a local network. An attacker with network access can trigger the fault, leading to service interruption. The vulnerability does not provide remote code execution or privilege escalation, so the risk is primarily confined to availability issues.
