A logic flaw in Apple’s image processing handling can be triggered by a maliciously crafted image, causing the receiving process to crash and resulting in a denial of service. The vulnerability exploits inadequate validation checks that were improved in newer releases. By supplying the crafted image, an attacker can cause interruption of normal operation, potentially impacting availability for local or remote applications that rely on image rendering.

Apple iOS 18.5 and later, iPadOS 18.5 and 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5 and later are secured against this issue. Earlier versions in each platform family are susceptible.

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% shows the vulnerability is unlikely to be actively exploited. It is not listed in CISA KEV, suggesting no known widespread exploitation. The likely attack vector is the delivery of a malicious image through any interface that accepts image input, such as a web browser, email client, or media application. An attacker would need to supply the crafted image to the target device; once processed, the exposed logic error can cause a crash and a temporary denial of service.