A memory corruption flaw allows an attacker with memory write capabilities to run code of their choice. The vulnerability is tied to improper state handling and can be triggered by writing to memory buffers, leading to execution of arbitrary instructions. This poses a severe threat to confidentiality, integrity, and system availability, permitting full compromise of the affected device.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are impacted. All releases before version 26.3 of each operating system are vulnerable, including iOS 26.2 and earlier, iPadOS 26.2 and earlier, macOS Tahoe 26.2 and earlier, tvOS 26.2 and earlier, visionOS 26.2 and earlier, and watchOS 26.2 and earlier.

The CVSS score of 7.8 indicates a high‑severity vulnerability, and the EPSS score of less than 1% suggests a low to moderate probability of exploitation under typical conditions. Nonetheless, the vulnerability is listed in CISA’s KEV catalog and has a documented exploitation against targeted individuals in older iOS versions, implying a real-world threat. The likely attack vector requires memory write capability, which could be achieved via local privilege escalation, malicious applications, or a compromised kernel. Once exploited, the attacker can achieve arbitrary code execution with the privileges of the compromised process.