The flaw is a memory corruption weakness (CWE‑400) caused by improper handling of a maliciously crafted video file. When such a file is processed, the operating system may terminate the receiving application or corrupt process memory, potentially resulting in a denial‑of‑service condition and creating a state that could be leveraged for further exploitation. This effect is limited to the process that opened the file, but can cause loss of data or interruption of user services.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS devices built on operating system versions prior to the patches listed in the References. Specifically, any system running iOS or iPadOS versions earlier than 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, or watchOS 11.4 is vulnerable until upgraded to the corresponding firmware release.

The CVSS score of 9.8 indicates a severe impact, while the EPSS score of 2% signals a low, but non‑zero, likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. The attack vector is inferred to be local or user‑initiated: a malicious video delivered via email, web download, or local media can activate the flaw. Given the high severity and the potential for denial‑of‑service, the overall risk remains high even though current exploitation probability is modest.