An input validation flaw, mitigated by improved memory handling, allows processing of a maliciously crafted file to terminate applications unexpectedly. The primary consequence is a denial of service to the affected user, as applications crash without predictable recovery. The weakness is classified as CWE‑20, indicating a failure to validate input properly, which can lead to abnormal termination when corrupted data is parsed. "The likely attack vector is delivering a specifically crafted file or payload to a vulnerable device, after which the impacted application aborts due to a memory handling error.

Apple systems including iOS and iPadOS, macOS Sequoia 15.6, tvOS 18.6, and visionOS 2.6 are impacted. The fix is provided in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and any preceding versions of the relevant operating system families are therefore considered vulnerable.

The CVSS score of 9.1 places this vulnerability in the high‑severity tier, highlighting the potential for critical disruption. EPSS indicates a very low probability of exploitation, though the flaw remains unreported as KEV. The attack scenario requires an attacker to supply a malformed file that the targeted application processes; no network-based trigger is documented, so the vulnerability is likely file‑delivery or file‑exposure dependent. Given the severity, the risk is significant for environments where application stability is mission critical.