An integer overflow was discovered in macOS input validation, allowing a specially crafted string to overwrite heap memory. The flaw arises from inadequate bounds checking when processing user‑supplied text, which is a classic integer overflow weakness (CWE‑190). If successfully triggered, the overflow causes heap corruption that could potentially lead to arbitrary code execution or system instability on the affected machine.

Apple macOS is the only vendor listed. Versions prior to macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.3 contain the vulnerability. These releases incorporate the integer overflow fix; thus, any macOS installation running an earlier release of the listed lines is at risk.

The CVSS base score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector is local or privileged exposure to a maliciously crafted string; therefore, an attacker would need to supply such input on a vulnerable system. No publicly documented exploits exist, although the heap corruption could be leveraged for code execution if an attacker can deliver the erroneous data.