The vulnerability arises from insufficient input validation in iOS and iPadOS, allowing an attacker to send malformed data that can force the operating system to crash or become unresponsive, resulting in a denial of service. This weakness corresponds to the improper input handling described by CWE-20 and compromises availability without affecting confidentiality or integrity.

Apple devices running iOS or iPadOS versions earlier than 26.7 are affected. The fix is integrated into iOS 26.7 and iPadOS 26.7, as well as subsequent releases such as iOS 27 and iPadOS 27. Any device that can receive data from a privileged network while running one of these older releases is at risk.

The CVSS score of 5.9 indicates moderate severity, while an EPSS score of less than 1% signals a low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, implying no confirmed public exploitation. Based on the description, it is inferred that an attacker must have privileged network access or be able to send data to the device from such a network in order to trigger the denial of service. A local attacker without network access has little chance of success.