Apple devices contain a bounds‑check bug that can corrupt memory when a file is processed. The vulnerability could allow an attacker to manipulate memory contents, potentially leading to arbitrary code execution or system instability. The weakness is classified under CWE‑119 (Buffer Overflow) and CWE‑787 (Out‑of‑Bounds Write).

Affected Apple operating systems include iOS 18.7.3 and later, iOS 26.2 and later, iPadOS 18.7.3 and later, iPadOS 26.2 and later, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2. All listed versions incorporate the mitigation for this issue.

The CVSS score of 8.8 indicates a high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation as of the latest data. The vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be local file handling, meaning a malicious or corrupted file could be introduced via user, email, or other storage media to trigger the failure. A successful exploitation chain would likely require the attacker to gain control over the target device’s input pipeline without significant additional privileges.