A buffer overflow in Apple’s image processing code, identified as CWE‑121, can be triggered by a maliciously crafted image. When that image is opened or rendered, the overflow corrupts process memory, potentially leading to crashes or unexpected behavior. The flaw undermines the integrity of the affected applications by allowing an attacker to overwrite memory regions, which could further be leveraged for more advanced attacks if additional vulnerabilities are present.

Apple iOS, iPadOS, macOS, tvOS, and watchOS are affected. Device firmware versions earlier than iOS 26.5, iPadOS 26.5, macOS 26.5, tvOS 26.5, and watchOS 26.5 contain the vulnerability; the bug was addressed in those releases.

The CVSS score is 7.5, indicating a high severity. The EPSS score of < 1% suggests that the probability of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious image file, so the likely attack vector is local, via email, messaging, or other file delivery channels. Because the flaw can corrupt process memory, it poses a significant risk if an attacker can convince a user to open the file.