This integer overflow in a macOS system framework carries a CVSS 9.8, but the EPSS sits at only 0.00417 — a significant gap that demands context before you prioritize patching. The disclosure states an app may be able to cause unexpected system termination, which sounds alarming, but the low EPSS tells you the security community hasn't observed active exploitation probes or reliable trigger development. That doesn't mean the bug isn't real — it means the exploitation path is either narrow, poorly understood, or both.
The simultaneous patch across Sequoia, Sonoma, and the unreleased Tahoe is the detail that matters most. This isn't a version-specific regression — it's shared system framework code that predates all three releases. The fix language ('improved input validation') is deliberately generic, but the cross-version timing tells you this is foundational code with wide reach.
Two non-obvious risks you should factor into prioritization. First: what does 'unexpected system termination' actually mean in practice? If it's a kernel panic requiring filesystem repair on next boot, that's a different severity class than a launchd daemon crash with clean recovery. Apple won't say, so treat the conservative case as your planning assumption. Second: don't anchor solely on the CVSS score. An integer overflow in a privileged framework path can corrupt memory beyond just triggering termination — function pointers, return addresses, and controlled writes in kernel-adjacent address space are all on the table if an attacker can control the overflow precisely. The CVE rates this as a denial-of-service issue; the actual exploit potential may be worse.
For practical response: treat this as a high-priority patch if your threat model includes targeted attacks against macOS systems with untrusted code execution, or if you deploy high-privilege third-party integrations that consume system frameworks. For general workstation fleets, the low EPSS suggests you have breathing room — but patch anyway, because when exploitation conditions become clearer, the window to act will be shorter.