Apple platforms contain a bounds‑checking flaw that can be triggered when parsing a specially crafted media file; the issue enables out‑of‑bounds memory access (CWE‑125). An attacker who can supply the malicious file to a vulnerable device may cause an application to terminate unexpectedly or corrupt its own process memory, potentially leading to loss of integrity or availability. No evidence of remote code execution or privilege escalation is provided in the current description.

The vulnerability affects Apple iOS and iPadOS devices, macOS, tvOS, visionOS, and watchOS. It is mitigated in iOS 18.7 and 26, iPadOS 18.7 and 26, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26.

The CVSS score of 5.5 classifies this as moderate severity; the EPSS score is below 1%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves the victim opening or otherwise interacting with a malicious media file on a device running an affected OS version. Successful exploitation would lead to application crashes or memory corruption but does not appear to provide broader system compromise.