The CVE identifies an out‑of‑bounds write flaw that was mitigated with enhanced bounds checking. The bug can allow an attacker to trigger an unexpected application termination, effectively amounting to a denial of service. The weakness is a classic memory corruption fault (CWE‑787) and does not provide remote code execution or data disclosure.

Apple iOS and iPadOS versions older than 18.7.10/26.6, macOS versions older than Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and all tvOS, visionOS, and watchOS releases prior to 26.6 are affected by this flaw.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating that exploitation is currently uncommon. The CVSS score of 8.8 classifies it as high severity. Based on the statement that an attacker may cause application crashes, the most likely attack vector is a local or a specially crafted payload delivered to a vulnerable app, as no remote exploitation is documented. The resulting risk is therefore high in terms of potential service disruption, but the likelihood of successful attack remains low.