A buffer overflow flaw classified as CWE‑119, CWE‑125, and CWE‑787 in Apple’s operating systems leads to an unexpected termination of applications when they parse a specially crafted file. The error arises from improper bounds checking during memory handling, causing an out‑of‑bounds write or read that ultimately crashes the target app. Based on the description, it is inferred that no code execution or privilege escalation path exists; the primary consequence is a denial of service for the affected application.

Apple’s mobile and desktop platforms—iOS, iPadOS, macOS, and visionOS—are impacted. Versions older than iOS 18.7.7, iPadOS 18.7.7, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and visionOS 26.4 contain the vulnerability and have been fixed in the listed releases and later.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or requires delivery of a malicious file to the target device; an attacker would need to supply a crafted file that the target application parses. Because the fault results only in a crash, the risk is limited to denial of service rather than privilege escalation or data loss.