An out‑of‑bounds write vulnerability was identified in several Apple operating systems, allowing a remote attacker to cause unexpected application termination or heap corruption. The weakness results from insufficient bounds checking during memory operations, which can destabilize the process and potentially lead to further exploitation if the corrupted memory is leveraged, although the CVE description does not indicate additional impacts beyond the corruption.

Vulnerable versions include Apple iOS 26.5 and older, iPadOS 26.5 and older, macOS Sequoia 15.7.7 and earlier, macOS Sonoma 14.8.7 and earlier, macOS Tahoe 26.5 and earlier, tvOS 26.5 and earlier, and visionOS 26.5 and earlier. Apple recommends upgrading to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 for the fix.

The CVSS score is 9.8, indicating a critical severity, but the EPSS score is <1%, which suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver malicious payloads that trigger the vulnerable code path, most plausibly via a remote vector. The expected effect is a denial of service through application termination or heap corruption. No evidence supports additional exploitation, such as code execution.