Technical impact
An integer underflow was discovered in how Apple’s operating systems validate image data. When a maliciously crafted image is processed, the underflow can cause memory corruption. The CVE entry does not specify the precise outcomes of that corruption, but memory corruption can potentially lead to serious issues.
Affected Systems
Apple’s iOS and iPadOS operating systems are affected in the 26.7.2 and 27.2 releases; macOS is impacted in the Golden Gate 27.2 release, Sequoia 15.8.2, and Tahoe 26.7.2. The vulnerability is mitigated only in those exact versions, so devices running older releases remain at risk.
Risk and Exploitability
CVSS score of 7.5 and EPSS score of < 1% are provided, and the issue is not listed in CISA’s KEV catalog, indicating that no public exploitation is known. The likely attack vector is supplying a malicious image to an Apple image-processing component; the attacker must deliver such an image to a vulnerable system. Because the flaw causes memory corruption, the severity is high while the likelihood of exploitation remains low based on the EPSS score. Regular patching remains the primary defense.
