The vulnerability arises from improper memory handling when a maliciously crafted video file is processed, which can trigger unexpected application termination or corrupt process memory. The flaw is classified as a memory corruption weakness (CWE-400) and may result in a denial‑of‑service condition or, potentially, unintended memory writes that could create a foothold for further exploits, though no such exploitation is confirmed in the current data.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS are affected when their operating system versions precede the following updates: iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Any device with an older version is vulnerable until updated to the specified releases.

The CVSS score of 9.8 signals a severe impact, yet the EPSS score of less than 1% indicates a very low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not actively leveraged in known attacks. Because the flaw is exposed through the handling of a video file, it is inferred that the attack vector is local or user‑initiated; a malicious file can be delivered via email, web, or local storage to trigger the corruption. While the risk level remains high, the likelihood of exploitation remains low, but the safety margin can quickly diminish if an attacker crafts a payload that achieves code execution from the corrupted memory state.