A malformed video file can trigger improper input handling in Apple's media framework, causing either an unexpected application termination or corrupting process memory. The flaw arises from insufficient input validation, which may undermine memory integrity during video processing and thus disrupt software reliability. This weakness does not appear to provide a direct path to arbitrary code execution but can lead to denial‑of‑service or uncontrolled memory corruption.

Apple iOS 18.5 and earlier, iPadOS 18.5 and 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, and watchOS 11.5 and earlier. Systems running any of the mentioned OS versions before the listed updates are potentially vulnerable and need to be patched.

The CVSS score of 6.3 indicates a medium severity flaw, and the EPSS score of <1% suggests a low probability of exploitation in the wild. Apple has not catalogued this issue in its KEV list, indicating that it is not currently known to be actively exploited. The attack vector is inferred to be local or remote delivery of a maliciously crafted video file, as the flaw is triggered when the OS processes such a file. An attacker with access to a device that can load the file might exploit this vulnerability to crash applications or corrupt process memory.