The vulnerability is an out-of-bounds access that arises from deficient bounds checking during file parsing. When a maliciously crafted file is processed, the flaw can cause an unexpected application termination, resulting in a denial-of-service condition. It is an integrity-related weakness that does not grant code execution but can disrupt service availability.

Apple devices running iOS, iPadOS, macOS (Tahoe), tvOS, visionOS, and watchOS are affected before the 26.5 release. The issue is fixed in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

The CVSS score is 6.5, and the EPSS score is <1%, indicating a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread use of an exploit. The flaw requires a malicious file to be parsed, so the likely attack vector is a local or externally supplied file that the user opens or the system processes. While no active exploit is documented, the risk is primarily a local denial-of-service that can affect user experience and potentially business operations that rely on the impacted applications.