An input validation flaw classified as CWE-20 allows an attacker to inject unexpected data that can lead to arbitrary execution of code on the device. The flaw caused Apple to remove the vulnerable code and fix it in the 26th release of its operating systems. If successfully exploited, the attacker could gain full control over the affected device, read or modify sensitive information, or compromise any network services running on the device.

The vulnerability affects Apple’s mobile and desktop platforms: iOS, iPadOS, macOS (the Tahoe series), tvOS, visionOS, and watchOS. All versions up to but not including version 26 are impacted; the issue is corrected in iOS 26, iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26.

With a CVSS score of 9.8, the flaw is considered critical. The EPSS score is less than 1%, suggesting that widespread exploitation may be rare, and the vulnerability is currently not listed in CISA’s KEV catalog. The lack of an explicitly stated attack vector in the description means the exact method of delivery is unknown; based on the nature of input validation weaknesses, the attack vector is likely remote through malicious data sent to an exposed service or via a malicious application. Because the flaw was removed from the code base, an exploit would need to rely on previous software iterations or unpatched devices.