An out-of-bounds access flaw was discovered in the media file parsing routine. The flaw is due to insufficient bounds checking, so a maliciously crafted media file can cause an unexpected app termination or corrupt the memory of the process handling the media. This could lead to application instability and, if the corrupted memory is exploited, potential compromise of the process.

The vulnerability affects Apple operating systems: iOS, iPadOS, macOS, tvOS, and visionOS. The issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, and visionOS 2.6. Any device running earlier versions of these operating systems is potentially affected.

The CVSS score of 7.1 indicates a high-level impact. The EPSS score of less than 1% points to a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local; an attacker who can supply a malicious media file to the target will trigger the fault. Because the flaw resides in media processing, any application that accepts media from untrusted sources could be impacted.