The vulnerability is an out-of-bounds write triggered when a maliciously crafted audio stream is processed. The insufficient bounds checking causes a memory write beyond the intended buffer which can corrupt memory and bring the targeted application to an unresponsive state, effectively terminating the process. This results in a denial of service and disrupts the normal functionality of the affected software. The weakness aligns with the standard CWE-787 (Out-of-Bounds Write).

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, and watchOS with build versions older than the releases that contain the fix are susceptible. Specifically, any iOS or iPadOS instance earlier than 26.6, macOS prior to Sequoia 15.7.8, macOS prior to Sonoma 14.8.8, macOS prior to Tahoe 26.6, tvOS prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6 may process the problematic media files, leading to crashes. Apple has addressed the issue in the stated releases, so upgrading removes the vulnerability.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Since the flaw primarily causes application termination rather than privilege escalation or data disclosure, the risk to confidentiality or integrity is low. Attackers would need to supply or otherwise trick the affected device into handling a malicious audio file, which could be achieved through local or remote media delivery in certain apps. Automated or targeted disruption is possible, so organizations should apply the patch promptly. Once deployed, the corrected bounds checks prevent the out-of-bounds write from occurring, eliminating the crash vector.