A flaw in the file parsing subsystem can cause an unexpected termination of the application when it processes a specially crafted file. The result is a crash that leads to a denial of service for the user until the app or the device is restarted. The weakness is due to insufficient input validation during parsing.

The vulnerability affects multiple Apple operating systems, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The fixes are shipped in iOS 18.3 and later, iPadOS 18.3 or 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3. All preceding releases are considered vulnerable.

The CVSS score of 6.5 indicates moderate severity for a denial‑of‑service loss. The EPSS score of < 1% implies a very low likelihood of wide‑scale exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. A likely exploitation vector would involve delivering a malicious file via mail, file sharing, or a website that triggers the parser; no special local privilege or authenticated access is required.