An out‑of‑bounds write was discovered in the image‑processing component of Apple’s operating systems when handling malicious image files. The flaw allows a crafted image to overwrite adjacent memory, resulting in arbitrary memory corruption. Because the corrupted memory can influence program control flow, the vulnerability is rated as a high‑risk condition capable of granting an attacker the ability to execute arbitrary code or otherwise disrupt system functionality. It is classified under CWE‑787.

Patch notes indicate that the vulnerability exists in iOS versions 15.8.5, 16.7.12 and 18.6.2, as well as their iPadOS counterparts (15.8.5, 16.7.12, 18.6.2, 17.7.10). For macOS, the affected releases include macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8. Devices running earlier builds than these specified versions are likely vulnerable.

Apple reports that the flaw has been leveraged in a highly sophisticated attack against a specific group of targets. The CVSS base score of 10 underscores the maximum severity, while a 4% EPSS suggests a non‑negligible likelihood of exploitation in the wild. Because the flaw is triggered by processing image data, an attacker could deliver the malicious file via email attachments, web content, or any service that renders images on the device. Being listed in the CISA KEV catalog further confirms that the vulnerability is actively exploited, making immediate remediation imperative.