The vulnerability lies in the operating system’s handling of media files; a crafted file can exploit a weakness in the input validation routine. This flaw can corrupt process memory or cause an application that processes the file to terminate unexpectedly. The description does not indicate that the corruption can be leveraged for code execution or privilege escalation.

Apple’s operating systems are affected: iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. All releases prior to these versions remain vulnerable until the update is applied.

The CVSS score is 6.5, and the EPSS score < 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. Likely delivery of a malicious media file would occur via email attachment, download, or streamed content, triggering the flaw during media parsing. Because the consequence is limited to application crashes or memory corruption without confirmed code‑execution potential, the overall risk is moderate to low in environments that enforce basic media handling controls.