This vulnerability arises from an out-of-bounds access due to insufficient bounds checking when processing media files on Apple iOS and iPadOS. Exploiting this flaw by supplying a maliciously crafted media file can lead to unexpected application termination or memory corruption within the affected process. Apple addressed the issue by improving bounds checking in iOS 18.7.5 and iPadOS 18.7.5, as well as in updates for macOS, tvOS, visionOS, and watchOS. The CVSS 3.1 base score is 7.8, reflecting high severity with high impact on confidentiality, integrity, and availability. The attack vector is local with low attack complexity, requiring user interaction but no privileges.

Successful exploitation can cause apps to crash unexpectedly or corrupt process memory, potentially leading to denial of service or arbitrary code execution within the affected process. The vulnerability impacts confidentiality, integrity, and availability of the affected system components. There are no reports of active exploitation in the wild.

Apple has released official fixes in iOS 18.7.5 and iPadOS 18.7.5 that address this vulnerability by improving bounds checking. Users and administrators should apply these updates promptly to mitigate the risk. Since this is not a cloud service, remediation depends on updating the affected devices. No additional mitigation steps are indicated by the vendor advisory.