An out‑of‑bounds read was discovered in Apple Pages and several Apple operating systems. The flaw permits a process that parses a maliciously crafted Pages document to read data beyond its intended buffer. The unintended read can cause the application to terminate unexpectedly or expose portions of the process memory, potentially leaking sensitive information. The weakness corresponds to CWE‑125, confirming a lack of proper bounds checking.

The vulnerability targets Apple Pages as well as the iOS, iPadOS, and macOS operating systems. The issue is resolved in Pages 15.1, iOS 26.1, iPadOS 26.1, and macOS Tahoe 26.1. Any earlier releases of these products are therefore susceptible, although the CVE does not list specific pre‑patch versions.

The CVSS score of 4.3 classifies this vulnerability as moderate, and the EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of this analysis. It is not included in the CISA KEV catalog. The attack vector is inferred to be local: a malicious Pages document must be opened by a user or processed by a third‑party application that handles such files. No additional environmental prerequisites are specified in the CVE data.