The issue arises when the operating system processes a maliciously crafted file, leading to an unexpected application termination. Apple has identified the flaw as a result of insufficient validation and has addressed it with improved checks in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.7, macOS Sonoma 14.8.8, macOS Tahoe 26.5, and visionOS 26.5. Because the vulnerability only causes a crash and does not allow code execution or privilege escalation, its impact is a denial‑of‑service condition for the affected application.

Apple has disclosed vulnerabilities in multiple product lines. Apple iOS and iPadOS versions prior to 18.7.9 and 26.5 contain the flaw. For macOS, the affected releases are Sequoia 15.7.8, Sonoma 14.8.7 and 14.8.8, and Tahoe 26.5. visionOS versions prior to 26.5 are also impacted. All other Apple operating systems are unaffected until the listed updates are installed.

The CVSS score of 7.5 classifies the flaw as high severity, yet the EPSS score of less than 1% suggests a very low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. It is inferred that the attacker would need to deliver a malicious file to a user—through phishing email, a malicious download, or removable media—and have the user open it. Because the flaw occurs during local file parsing and is not triggered over a network, remote exploitation is unlikely based on the available information.