The vulnerability is a logic flaw that arises when Apple’s iOS, iPadOS, macOS, visionOS, or watchOS processes a maliciously crafted photo or video that is shared via an iCloud link. The flaw may allow an attacker to execute code or otherwise compromise the device, because the system trusts media received from iCloud links before applying security checks. Apple reports that the flaw may have already been exploited in a highly sophisticated attack against targeted individuals, indicating the possibility of serious compromise.

Affected Apple operating systems include iOS 15.8.4, 16.7.11, and 18.3.1; iPadOS 15.8.4, 16.7.11, 18.3.1, and 17.7.5; macOS Sequoia 15.3.1, Sonoma 14.7.4, and Ventura 13.7.4; visionOS 2.3.1; and watchOS 11.3.1.

The CVSS score of 4.2 indicates a moderate risk level, and the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread. However, the listing in CISA’s KEV catalog confirms that real-world attacks have occurred. The likely attack vector is delivering a malicious iCloud link through email, messaging, or social engineering, allowing the attacker to exploit the logic flaw when the target opens the link. Successful exploitation could lead to code execution, data theft, or persistent infection.