This vulnerability involves an out-of-bounds write (CWE-787) in Apple iOS and iPadOS that may allow a malicious app to cause unexpected system termination, impacting system availability. Apple fixed the issue by improving bounds checking in iOS 26.6 and iPadOS 26.6, as well as in other Apple operating systems. The CVSS v3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or integrity impact, and high impact on availability.

An attacker with local access and the ability to trick a user into interacting with a malicious app could cause the system to terminate unexpectedly, leading to denial of service. There is no impact on confidentiality or integrity of the system. No known exploits are reported in the wild.

A fix is available and included in iOS 26.6 and iPadOS 26.6. Users and administrators should update affected devices to these versions or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official OS update from Apple.