An out‑of‑bounds read occurs while parsing specially crafted media files, allowing the parser to read beyond its intended memory bounds. The improper bounds checking may corrupt process memory or cause the application to terminate unexpectedly. This flaw corresponds to CWE‑125, which represents read out of bounds during array or buffer handling. Based on the description, the impact is limited to memory corruption and crash, with no direct mention of code execution. However, the description notes the potential for corrupting process memory, which may serve as a foothold for further exploitation if the vulnerable process runs with elevated privileges.

Apple's operating systems receive the patch. Affected versions are iOS 18.7.5 and 26.3, iPadOS 18.7.5 and 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3.

The flaw carries a CVSS score of 7.8, indicating high severity, while the EPSS score is below 1 %, meaning a low probability of current exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is a locally or remotely delivered malicious media file that the system or a vulnerable application processes automatically. Based on the possibility of memory corruption, it is inferred that an attacker could potentially leverage this flaw for privilege escalation or arbitrary code execution in contexts where the affected process runs with elevated privileges.