Processing a maliciously crafted media file may corrupt process memory or cause the application to terminate unexpectedly. This vulnerability arises from insufficient input validation, allowing an attacker to influence internal data structures during media parsing, which could lead to integrity violations or denial of service. The weakness is classified as CWE‑20, which represents improper input validation.

The flaw affects Apple’s mobile and desktop operating systems, including iOS and iPadOS, macOS, tvOS, visionOS, and watchOS. Affected versions are iOS 26 and iPadOS 26, macOS Sonoma 14.8.2 and macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26.

The CVSS score of 6.5 indicates moderate severity. EPSS is below 1%, so the probability of exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker delivering a specially crafted media file to a vulnerable application. If exploited, the attacker could potentially cause process crashes or overwrite critical memory, leading to denial of service or integrity compromise. Given the low EPSS, widespread exploitation is unlikely at this time.