A flaw in the operating system's memory handling logic permits an out-of-bounds write when processing a file, resulting in memory corruption. This can allow an attacker to run arbitrary code or crash the system, as the weakness aligns with the buffer overflow category, identified as CWE‑787.

Apple iOS, iPadOS, and macOS devices running versions earlier than iOS 18.6, iPadOS 18.6, or macOS Sequoia 15.6 are affected. The patch that addresses the issue has been incorporated into those releases, so updating to the latest OS versions removes the vulnerability.

The base CVSS score of 8.8 places this flaw in the high severity range, indicating a significant impact if exploited. The EPSS score of less than 1 % suggests that widespread exploitation is currently unlikely, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker must deliver a crafted file to a vulnerable application, pointing to a local or application‑specific attack vector rather than remote exploitation.