A buffer overflow in the image handling component can be triggered by a maliciously crafted image. This causes corruption of process memory, potentially allowing an attacker to alter program execution, disclose confidential data, or crash the system. The weakness corresponds to CWE-787, where improper bounds checking leads to illegal memory access.

Apple macOS is affected. Versions prior to macOS Sequoia 15.6 are vulnerable; the issue is fixed in 15.6 and later releases.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests low current exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is local execution of a malicious image, such as opening a crafted file or receiving it via email or web download. If exploited, an attacker could gain execution privileges or disrupt application availability.