An out-of-bounds memory access flaw was identified in the media file processing components of Apple operating systems. When a maliciously crafted media file is processed, the vulnerability can overflow bounds and corrupt process memory, potentially causing app termination or, in some circumstances, unintended code execution. The weakness is known as an out-of-bounds buffer overread/overwrite and is mapped to CWE‑125.

Apple’s iOS, iPadOS, macOS, tvOS, and visionOS are affected. The flaw is fixed in iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, and visionOS 26.1, so any earlier system versions remain vulnerable.

The CVSS score of 7.8 indicates high severity, and the EPSS score of less than 1% suggests the vulnerability is currently unlikely to be widely exploited, though it is still possible. The defect is not listed in the CISA KEV catalog, so no confirmed exploitation has been reported. Attackers who can supply a crafted media file to the affected device or application could trigger the memory corruption, leading to denial of service or potential malicious code execution.