Technical impact
A flaw in the file‑parsing code performs an out‑of‑bounds memory read, allowing a malformed or malicious file to expose contents of memory that were not intended to be disclosed. The vulnerability is classified as CWE‑125 and can result in the leakage of sensitive user data, such as personal information or credentials, to the application or process that processed the file. The impact is higher for applications handling user‑provided data and occurs as soon as the vulnerable routine parses the file.
Affected Systems
Affected platforms are all Apple operating systems that preceded the security updates mentioned in the advisory. iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions before iOS 18.3, iPadOS 18.3 or 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3 are vulnerable. Devices running these older releases and any apps that invoke the vulnerable parsing routine are at risk.
Risk and Exploitability
The CVSS score of 5.5 indicates moderate severity, and the low EPSS score of <1% suggests that exploitation is unlikely but still possible. The flaw is not listed in CISA's KEV catalog. Based on the description, it is inferred that attackers would need to deliver a specifically crafted file to a susceptible application; the attack vector is local or user‑initiated rather than remote. Once the file is processed, memory reads beyond the intended bounds may reveal private data to the interested party.
EUVD