An integer overflow occurs when the system processes data that exceeds the limits of an integer variable. In this case the flaw is in an input‑validation routine that can be triggered by a malicious application. When exploited, the overflow allows the app to break out of its sandbox, potentially gaining unauthorized access to the host operating system and the data of other apps. This escalates privileges and compromises confidentiality, integrity, and availability of the device.

Apple devices running iOS, iPadOS, macOS, and watchOS are affected. The vulnerability is fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, and watchOS 26.6. Devices with earlier versions remain at risk.

The CVSS score of 8.6 indicates high severity, while the EPSS score of < 1% suggests a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, with attackers supplying crafted data through a malicious or compromised app already installed on the device. Because the flaw stems from insufficient input validation in a sandboxed component, exploitation would allow the app to escape its sandbox, granting unauthorized access to the host OS and potentially other apps. Updating the OS to the patched releases mitigates the risk and prevents exploitation.