The vulnerability is caused by insufficient bounds checking when processing a maliciously crafted file, leading to an unexpected application termination. The flaw can be exploited to crash an application whenever it opens a carefully constructed file, resulting in a denial‑of‑service condition for the user or system that depends on the affected software. This is consistent with a CWE‑787 type out‑of‑bounds memory access and presents no documented code‑execution vector.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The issue is fixed in iOS 18.7.9, iOS 26.5, iPadOS 18.7.9, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

Because no CVSS or EPSS score is published, the exact value of the risk cannot be quantified. However, the problem requires only a malicious local file to trigger the crash, so the attack surface is limited to users or processes that open such files. The vulnerability is not listed in the KEV catalog and no exploitation reports are known, but it represents a moderate to high risk of denial‑of‑service for affected applications.