A flaw in how macOS processes environment variables can allow an application to trigger an unexpected system termination. The vulnerability stems from insufficient validation of these variables, leading to a crash that impacts the entire system rather than just the offending application. Such termination can disrupt user workflow and compromise service availability.

Apple macOS is affected at versions before macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6. The fix is included in those releases, and earlier versions lack the improved validation.

The EPSS score indicates less than 1% exploitation probability, and the issue is not listed in CISA KEV, pointing to low publicly known exploitation activity. A CVSS score of 9.8 signals critical severity. The likely attack vector is local, requiring an application that sets or modifies environment variables to trigger a crash that terminates the entire system. With no known public exploits, the risk remains chiefly a destructive denial of service rather than a persistent compromise.