A memory corruption flaw in how Apple’s operating systems parse textures can be exploited by supplying a specially crafted texture. The insufficient input validation leads directly to a crash, terminating the application that processes the texture. This type of fault falls under input validation weaknesses (CWE‑20) and, in the worst case, can be used to deny service to the affected application. The description does not indicate that an attacker gains code execution or other privileges.

The vulnerability affects Apple’s major platforms: iOS and iPadOS, macOS, tvOS, visionOS, and watchOS. The problem is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Systems running earlier versions of these operating systems remain susceptible.

The CVSS score of 9.8 signals a critical severity, yet the EPSS score of less than 1 % indicates a very low likelihood that this vulnerability is currently being exploited in the wild. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local: an attacker would need to deliver a malicious texture to an application that processes textures, which could occur through a malicious app, compromised media, or a trusted app loaded with malicious data. No remote exploitation path is explicitly documented.