Technical impact
An out‑of‑bounds read occurs in Apple’s handling of image data, due to insufficient bounds checking. Processing a maliciously crafted image can cause an unexpected application termination, resulting in a denial‑of-service for the user. The description does not indicate an information‑disclosure or execution flaw, so the primary consequence is loss of availability of the affected application or system.
Affected Systems
Affected Apple products include iOS and iPadOS, all released versions from iOS 26.7.2 and iPadOS 26.7.2 through iOS 27.2 and iPadOS 27.2, macOS from the Golden Gate 27.2 and Sequoia 15.8.2 releases including the Tahoe 26.7.2 update, and visionOS 27.2. Devices running any of these operating systems and any applications that process image files are susceptible.
Risk and Exploitability
The CVSS score is 6.5, EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a crafted image to an application that processes images, such as a web browser, mail client, or photo viewer, which can be performed remotely via a malicious website or email attachment. Because the flaw only causes application termination, immediate exploitation by a remote attacker would require the image to be processed, making the threat more relevant to environments where untrusted image input is common and less severe than code execution or data leakage.
