The vulnerability arises from improper bounds checking when processing audio files, resulting in a memory corruption flaw classified as CWE-119. If an attacker supplies a maliciously crafted audio file, the corrupted memory may lead to a crash or, in the worst case, allow execution of arbitrary code by corrupting execution control data. The report explicitly mentions memory corruption and the possibility of code execution, so the threat is inferred to include remote code execution potential.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, and watchOS prior to the updates listed in the advisory are affected. The fix is available in iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.8, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Any device running an older version within this family remains vulnerable.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by embedding a malicious audio file into a media stream or local file that the system will play, triggering the audio subsystem’s insufficient bounds checking and potentially overflowing a buffer to corrupt memory.