Apple operating systems contain a bounds‑check bug that can corrupt memory when a file is processed. The flaw may allow an attacker to manipulate memory contents, leading potentially to arbitrary code execution or system instability. The weakness is classified under CWE‑119 and CWE‑787, though the specific impact of code execution is inferred from the memory corruption behavior.

Versions of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS that run before the fixed releases—iOS 18.7.3 or 26.2, iPadOS 18.7.3 or 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2—are vulnerable. All releases that include the improved bounds checks are considered secure.

The CVSS score of 8.8 indicates a high severity. An EPSS score of 6% suggests a moderate likelihood that this bug will be exploited. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation would involve local file handling, where a malicious or corrupted file supplied by an attacker can trigger the memory corruption. The impact would depend on the context, but full exploitation would require an attacker to influence the file input pathway without additional privileges.