Technical impact
Improper handling of a specially crafted file while parsing can cause an unexpected termination of the application, resulting in a denial of service that may affect user experience and data continuity. The vulnerability is described as an improper resource shutdown or release flaw, reflected by CWE‑404. The CVSS score of 4.3 indicates moderate severity, primarily impacting availability and stability of the application but not exposing sensitive data directly.
Affected Systems
Apple’s operating systems—including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS—are affected. The issue was fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3. Users of earlier releases should check for and install these updates.
Risk and Exploitability
The EPSS score of 1 % indicates that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog, further reducing the chance of widespread exploitation. However, the attack vector is inferred to be local: an attacker would need access to deliver a malicious file to the target user. Once the file is processed, the application crashes, potentially affecting usability and causing a denial of service for legitimate users.
EUVD