The vulnerability is a buffer overflow in macOS kernel code that arises from insufficient bounds checking. It was fixed in macOS Sequoia 15.7.8, Sequoia 15.8.2, Sonoma 14.8.8, and Tahoe 26.6. A remote attacker may exploit the flaw to cause unexpected system termination or corrupt kernel memory. This is a classic stack‑based buffer overflow classified as CWE‑120.

Apple macOS versions released prior to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 are affected. Systems running any earlier major release are susceptible to this flaw.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is remote, where an attacker can provide crafted data—potentially via network services to trigger the overflow without local privileges.