An out‑of‑bounds write vulnerability was identified in Apple operating systems. The flaw occurs when an application writes beyond the limits of a buffer, potentially corrupting memory and leading to unexpected system termination. This results in a denial of service for the user and is classified under CWE‑787. The vulnerability was addressed with improved bounds checking in the affected code base.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS with firmware versions older than 26.6 are susceptible. The issue was resolved in release 26.6 on all these platforms, so any system still on a prior firmware is in need of an update.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploits. The likely attack vector involves a malicious or compromised third‑party application that triggers the out‑of‑bounds write through a specific API. The flaw does not provide arbitrary code execution on its own but can cause a denial of service and might serve as a foothold in a larger attack sequence. Consequently, organizations should treat this as a low‑to‑moderate risk that warrants timely patching.