A flaw in Apple’s container and containerization tools allows an attacker who controls the registry, a mirror, or the network path to it to deliver arbitrary image content when a pull is done by digest. The system previously failed to verify that the content matched the pinned digest, enabling execution of a different, potentially malicious image under a legitimate name. This vulnerability can result in full compromise of the host running the container, as the attacker effectively injects and runs arbitrary code. The weakness is a failure of input validation during the pull process.

Apple’s container tool (version 1.6.0) and containerization framework (version 0.52.1) are affected. Systems that use these components to pull images by digest are vulnerable, regardless of the image repository, if the registry can be tampered with.

The vulnerability permits exploitation whenever an attacker can influence registry responses, giving it a high likelihood in environments with unsecured or mirrored registries. The fix introduces a digest comparison step and hash verification for manifests and blobs, but tag pulls remain exempt because tags are mutable by design. No CVSS score is supplied; EPSS is not available and the vulnerability is not in the CISA KEV catalog. Nevertheless, the potential for Remote Code Execution remains significant.