The vulnerability is an out‑of‑bounds read within Apple’s audio stream processing routine, classified as CWE‑125. When a media file containing maliciously crafted audio data is parsed, the bounds check fails, causing the application to read memory outside the intended bounds and terminate the audio‑processing process. The immediate effect is a denial of service for the process handling the file, with no evidence of code execution or data leakage.

Apple operating systems—iOS, iPadOS, macOS (Sequoia 15.7.5, Sonoma 14.8.5, Tahoe 26.4), tvOS, visionOS, watchOS—are affected in all releases that precede iOS 18.7.7 or 26.4, iPadOS 18.7.7 or 26.4, and the corresponding macOS, tvOS, visionOS, and watchOS builds. All vulnerable versions lack the improved bounds checking that fixed the issue.

The CVSS score of 6.5 categorizes the flaw as moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no widespread attacks have been observed. Based on the description, it is inferred that an attacker must supply a malicious audio file that triggers the vulnerable parsing code; this could occur through a local upload, a compromised media service, or a file transmitted over a network, resulting in a process crash but not in code execution.