The flaw originates from missing validation during the parsing of certain files, which can cause an application to terminate unexpectedly. The immediate effect is a denial of service to the end user, as the app crashes when presented with crafted input. No known path to arbitrary code execution is documented, so the risk is limited to service disruption. The weakness aligns with improper input validation.

Apple devices running iOS 18.3, iPadOS 18.3 and 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3 are susceptible. Earlier or earlier minor versions of these operating systems are not explicitly mentioned as affected.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local access to supply a malicious file to a vulnerable application, making the attack vector likely to be file-based or potentially remote if the app accepts external input. Given the low exploitation probability and absence from KEV, the risk is moderate but should be mitigated through patching.