An out-of-bounds read occurs when the system processes a maliciously crafted image, allowing an attacker to read process memory that it should not be able to access. This flaw permits an adversary to expose sensitive information stored in memory, potentially including credentials, cryptographic material, or other confidential data. The vulnerability is a classic buffer over-read (CWE‑125) and can lead to accidental or intentional disclosure of data within the process space.

The flaw affects Apple devices across multiple platforms: iOS and iPadOS (vulnerability fixed in iOS 18.6, iPadOS 18.6 and 17.7.9), macOS (Sequoia 15.6 and Sonoma 14.7.7), tvOS (18.6), visionOS (2.6) and watchOS (11.6). Devices running earlier releases of these operating systems are susceptible.

The CVSS score of 4 indicates a moderate impact, but the EPSS score of less than 1% reflects a low likelihood of widespread exploitation at this time. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation would require delivery of a crafted image to the target device, typically through an application that handles user-provided images. While the flaw is limited to memory disclosure and does not directly grant executable code execution, the data exposed could enable further attacks or facilitate credential theft. The low EPSS suggests that active exploitation is presently uncommon, but the presence of the vulnerability in multiple widely used Apple platforms warrants proactive mitigation.