An out‑of‑bounds read flaw occurs when the operating system parses certain files, allowing the executing process to read data beyond the intended buffer. This bug falls under CWE‑125 and can expose sensitive user information that resides in adjacent memory. No execution of arbitrary code or denial of service is directly associated with the flaw; the primary consequence is the inadvertent leak of confidential data.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. Prior to the releases listed below the vulnerability was present. The issue is fixed in iOS 18.5, iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, and watchOS 11.5. All earlier versions of these operating systems that have not received these updates remain vulnerable.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score of less than 1 % implies a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited known exploitation. Attackers would need to supply a crafted file that is parsed by a vulnerable component; the flaw does not expose remote attack vectors or privilege escalation. When a malicious file is processed, the out‑of‑bounds read can leak data to the attacker observing the process’s memory or logs.