Technical impact
An out-of-bounds write was discovered in Apple’s image‑processing component when handling malicious image files. The flaw allows crafted content to overwrite adjacent memory, resulting in arbitrary memory corruption that could influence program control flow. It is classified under CWE-787.
Affected Systems
Patch notes indicate that the vulnerability exists in iOS versions 15.8.5, 16.7.12 and 18.6.2, as well as their iPadOS counterparts (15.8.5, 16.7.12, 18.6.2, 17.7.10). For macOS, the affected releases include macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8. Devices running earlier builds than these specified versions are likely vulnerable.
Risk and Exploitability
This vulnerability has been leveraged in a highly sophisticated attack against a specific group of targets. With a CVSS base score of 10, the severity remains at maximum. The EPSS score of 63% indicates a high likelihood of exploitation in the wild. The most likely attack vector is the delivery of malicious image files via email attachments, web content, or any service that renders images on the device. Based on the description, it is inferred that the memory corruption could enable remote code execution, though the exact exploitation path is not fully documented. Being listed in the CISA KEV catalog confirms that the vulnerability has been actively exploited, making immediate remediation imperative.
EUVD