Technical impact
A type confusion flaw was mitigated with enhanced memory management, but the flaw could let an application repeatedly corrupt memory and force a crash, resulting in a denial of service. The weakness arises from the runtime incorrectly interpreting an object type and thus accessing memory that does not belong to it, which can terminate the vulnerable process. The impact is limited to application availability, as no evidence of privilege escalation or data disclosure is reported.
Affected Systems
Apple products including iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 are affected.
Risk and Exploitability
The CVSS score is 5.5 and the EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack likely requires the user to run a malicious application locally to trigger the type confusion and crash the targeted app. Exploitation is possible but would need a malicious app on the device; no remote code execution vector is identified. The risk is considered moderate, with patching advised as the primary mitigation.
