When a media file is parsed by the affected Apple operating systems, insufficient bounds checking can cause an out‑of‑bounds read or write. The flaw, identified as CWE-125 and CWE-787, may trigger an unexpected application termination or lead to corruption of process memory. The primary consequence is a denial of service through application crashes, with no evidence of privilege escalation in the provided description.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are all impacted. The issue is remedied in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Devices running older builds remain susceptible.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation in the wild is unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a synthetically crafted media file—typically via email, a website, or an application that automatically processes media—for the issue to be triggered. Successful exploitation results in a denial of service through application crash or memory corruption, but the description does not support claims of higher impact such as privilege escalation.