Apple’s operating systems contain a buffer overflow caused by insufficient size validation in a core component. A malicious or compromised application can trigger the overflow and execute arbitrary code with kernel privileges, giving the attacker full control of the device. This weakness is a classic example of CWE‑120: incorrect handling of memory buffer size.

The flaw impacts Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions released before the patched releases listed in the Apple advisory. Specifically, all iOS and iPadOS versions earlier than 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, tvOS before 26.6, visionOS before 26.6, and watchOS before 26.6 are potentially vulnerable. The patched releases listed have addressed the issue.

The CVSS score of 7.8 indicates a high‑severity vulnerability, and the EPSS score of <1% suggests a very low but non‑zero probability of exploitation. It is not listed in CISA’s KEV catalog. The flaw allows kernel‑level code execution, effectively giving the attacker full control of the device. The likely attack vector is inferred to be local, requiring the attacker to run a malicious or compromised app that can trigger the buffer overflow.