An out-of-bounds access flaw exists in the media file processing components of several Apple operating systems. When a specially crafted media file is processed, the system can experience unexpected app termination or corruption of process memory. The flaw is a buffer over-read (CWE‑125), which may allow an attacker to influence the stability of the affected application.

Affected systems include Apple iOS and iPadOS (vulnerable before 18.7.2 and 26.1), macOS Sequoia 15.7.2 and macOS Tahoe 26.1, as well as tvOS 26.1 and visionOS 26.1. All affected versions have been fixed in the listed releases.

The CVSS score of 4.3 indicates a low‑to‑moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue. The most likely attack vector is a local or remote user delivering a malicious media file that is opened by any application capable of processing that file type. If exploited, an attacker could cause application crashes or destabilize the process memory of the victim device.