An out‑of‑bounds access flaw has been identified in the media handling component of Apple operating systems. The issue allows a maliciously crafted media file to bypass bounds checks and write beyond the intended buffer. Executing such a file can trigger an unexpected application termination or corrupt the memory of the process that handled it, potentially affecting data integrity. The flaw is described as a buffer overwrite that could lead to memory corruption but does not provide a path to arbitrary code execution.

The vulnerability impacts Apple platforms: iOS, iPadOS, macOS, tvOS, and visionOS. The official Apple support pages show that the fix is included in iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, and visionOS 2.6. Devices running earlier releases of these operating systems are therefore considered vulnerable. The CVE description does not list specific earlier version numbers, so it is inferred that any version prior to the fixed releases is affected.

The CVSS score of 7.1 classifies the vulnerability as high severity. The EPSS score of less than 1 % indicates a very low likelihood of exploitation at present, and the flaw is not listed in the CISA KEV catalog. The most plausible attack vector involves delivering a malformed media file to the device—for example, through an email attachment, a compromised download, or streaming content—that is then processed by the operating system. The vulnerability requires the file to be parsed by the media component; it does not currently allow arbitrary code execution or compromise the device at the network level.