A mismanagement of memory during audio file processing can corrupt process memory when a maliciously crafted audio file is presented. The compromise arises from flawed handling of audio data in the system’s media stack, potentially overwriting or altering memory regions. If the corrupted memory region belongs to an actively running process, this could lead to an application crash or denial of service. The underlying flaw aligns with CWE-119.

Apple iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. All listed operating systems incorporate the vulnerable audio handling components and are affected by the memory corruption flaw.

Exploitation requires crafting a malicious audio file that can corrupt process memory when processed by the vulnerable audio handling components. The flaw is a classic buffer overflow (CWE-119). With a CVSS score of 7.8, this vulnerability is considered high severity. The attack vector is not explicitly documented, but any channel that allows a device to process an audio file could be used. The EPSS score of <1% indicates a low exploitation probability, and the flaw is not listed in the CISA KEV catalog, suggesting public exploitation may be limited. Nonetheless, the absence of a KEV listing does not diminish the need for timely remediation.