By whom and when can transaction malleability be applied?
The underlying data cannot be changed, only the signature thus id can.  It can be altered by anyone with knowledge of how to alter digital signatures while not invalidating them.

If it's a valid transaction, either the altered or unaltered version can be included in the blockchain.

Once it's cemented into the blockchain, the signature thus id cannot be changed.