The updated description confirms a buffer overflow in Apple’s image processing code, identified as CWE‑121, that can be triggered by a maliciously crafted image. When that image is processed, the overflow corrupts process memory, which could lead to crashes or other unintended behavior. This error undermines the integrity of the affected applications by permitting memory overwrites that might be used for more complex attacks if other weaknesses exist.

Apple iOS, iPadOS, macOS, tvOS, and watchOS are affected. Device firmware versions earlier than iOS 26.5, iPadOS 26.5, macOS 26.5, tvOS 26.5, and watchOS 26.5 contain the vulnerability; the bug was addressed in those releases.

The CVSS score is 7.5, indicating a high severity. The EPSS score of < 1% suggests that the probability of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious image file, so the likely attack vector is local, via email, messaging, or other file delivery channels. Because the flaw can corrupt process memory, it poses a significant risk if an attacker can convince a user to open the file.