An integer underflow was introduced in the handling of network file server requests on macOS. The flaw, arising from insufficient input validation, allows a calculated numeric value to fall below the representable minimum. When this underflow occurs, the system may terminate unexpectedly, resulting in a denial of service. The weakness is reflected in CWE-190 and CWE-20.

Apple macOS versions that have not yet applied the patched releases are vulnerable. The fix was released with macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so any earlier local or beta installations lacking these updates remain impacted.

The EPSS score of < 1% and the CVSS base score of 5.9 suggest moderate risk and low exploitation likelihood. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation. Based on the description, the attack vector is inferred to be remote, requiring a rogue network file server to provide malformed input. The effect is denial of service through forced system termination once the integer underflow triggers a crash.