An out-of-bounds write was discovered in Apple’s image‑processing component when handling malicious image files. The flaw allows crafted content to overwrite adjacent memory, resulting in arbitrary memory corruption that could influence program control flow. It is classified under CWE-787.

Patch notes indicate that the vulnerability exists in iOS versions 15.8.5, 16.7.12 and 18.6.2, as well as their iPadOS counterparts (15.8.5, 16.7.12, 18.6.2, 17.7.10). For macOS, the affected releases include macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8. Devices running earlier builds than these specified versions are likely vulnerable.

Apple reports that the flaw has been leveraged in a highly sophisticated attack against a specific group of targets. The CVSS base score of 10 underscores the maximum severity, while an EPSS of less than 1% indicates a low likelihood of exploitation in the wild. The likely attack vector is the delivery of malicious image files via email attachments, web content, or any service that renders images on the device. Based on the description, it is inferred that the memory corruption could enable remote code execution, though the exact exploitation path is not fully documented. Being listed in the CISA KEV catalog confirms that the vulnerability has been actively exploited, making immediate remediation imperative.