A malformed file can trigger an out‑of‑bounds read in several Apple operating systems. The insufficient input validation allows the OS to read beyond the intended buffer, which can cause a crash or expose contents of adjacent memory locations. The result is either a denial of service or the leaking of potentially sensitive data. The weakness is classified as CWE‑125.

Affected Apple systems include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The issue is corrected in iOS 18.4, iPadOS 18.4 and 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Users running earlier releases are vulnerable.

The CVSS score of 5.5 indicates a medium severity, while the EPSS score of less than 1% shows a very low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog, further suggesting limited known exploitation. The likely attack vector involves a maliciously crafted file being processed by the OS, which could be local or delivered remotely if the file is handled by a service exposed to external input. Successful exploitation may lead to a system crash or disclosure of memory contents, but would require the attacker to supply the crafted file and trigger the vulnerable processing path.