The vulnerability is an out‑of‑bounds write triggered when a maliciously crafted file is processed by the operating system. The flaw results from insufficient bounds checking during file handling, allowing the attacker to corrupt memory and cause a crash. This can lead to a denial of service for the affected Apple devices, as indicated by the CVSS score of 5.5 and the CWE‑787 classification.

Apple products are affected. Vulnerable releases include iOS and iPadOS versions prior to 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, tvOS before 26.6, visionOS before 26.6, and watchOS before 26.6. The fix has been released in the listed newer versions.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % shows a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting no public exploits yet. The likely attack vector is the delivery of a malicious file through downloads, email attachments, or connected storage – these are inferred because the description states that processing a maliciously crafted file may trigger the flaw. Successful exploitation would crash the operating system or critical services, resulting in denial of service.