A memory handling bug in Apple operating systems causes an unexpected process crash when a user processes maliciously crafted web content, resulting in a denial‑of‑service for the affected device. The flaw does not provide privilege escalation or remote code execution; the effect is limited to availability loss.

The vulnerability affects Apple iOS, iPadOS and macOS Tahoe. It has been fixed in iOS 26.5.2, iPadOS 26.5.2 and macOS Tahoe 26.5.2, and any releases thereafter.

The EPSS score is not available and the vulnerability is not listed in CISA KEV. The flaw can be triggered by loading malicious web content through a browser or any web‑enabled application, which is a likely attack vector. Because the impact is only an application crash and no control‑flow takeover is possible, the risk is moderate and primarily an availability threat for single devices, with exploitation being relatively straightforward in a user‑directed attack.