The vulnerability in icloudpd arises from Werkzeug's safe_join function, which improperly allows Windows special device names like CON and AUX in path segments. On Windows systems, these device names exist implicitly in every directory and can be opened but cause reading operations to hang indefinitely. This affects icloudpd versions from 1.21.0 up to but not including 1.32.3. A fix is available in version 1.32.3.