Technical impact
This vulnerability arises from insufficient memory handling in macOS's image processing subsystem. A maliciously crafted image can corrupt process memory, potentially causing application crashes or other unintended behavior. The weakness aligns with classic buffer overflow conditions outlined by CWE-119.
Affected Systems
Apple macOS systems running any version older than Sequoia 15.7.7, Sonoma 14.8.7, or Tahoe 26.5 are affected, as the patch was incorporated in those releases.
Risk and Exploitability
The CVSS score of 7.5 denotes a medium‑high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker would deliver a malicious image through user‑controllable inputs such as files, network traffic, or web content; no public exploit has been documented, but the lack of automatic mitigations means local or remote attackers capable of influencing image input could potentially exploit the flaw.
