An out‑of‑bounds access issue was identified in the processing of media files, which was mitigated with improved bounds checking. If an attacker supplies a malformed media file, the affected application may terminate unexpectedly or its memory could become corrupted. This flaw does not directly grant code execution but can lead to instability that may be leveraged in broader attacks.

Apple devices running iOS, iPadOS, macOS, tvOS, or visionOS are affected. The vulnerability exists in iOS 18.7.2 and iOS 26.1, iPadOS 18.7.2 and iPadOS 26.1, macOS Sequoia 15.7.2 and macOS Tahoe 26.1, tvOS 26.1, and visionOS 26.1.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. It is not currently listed in the CISA KEV catalogue, so no widespread exploitation has been observed. The likely attack vector involves a maliciously crafted media file, but successful exploitation requires the user to process such a file, making the risk largely limited to users who open untrusted content.