The vulnerability exists in Apple Compressor because the service accepts external connections without authentication. When enabled, an unauthenticated user on the same network can send crafted requests that cause the Compressor process to execute arbitrary code, potentially allowing full control of the impacted machine. The weakness corresponds to improper access control (CWE‑284).

Apple Compressor, versions prior to 4.11.1, running on any supported platform where external networking is enabled. All machines that expose the Compressor service to local network traffic are affected.

The CVSS score of 8.8 indicates a high severity flaw, yet the EPSS score is less than 1%, suggesting low current exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is a local network attacker without authentication, with the necessary precondition of the Compressor service accepting external connections. Exploitation therefore requires the attacker to be on the same subnet and to reach the service endpoint.