A flaw in Apple’s image handling incorrectly manages memory when decoding a specially crafted image. The resulting corruption can overwrite critical data structures, enabling attackers to execute arbitrary code or crash affected applications. The root weakness aligns with overflow or out‑of‑bounds memory handling issues.

Apple’s iOS, iPadOS, macOS, tvOS, and visionOS are affected. The vulnerability is fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6; earlier releases are unpatched.

The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the issue is not listed in CISA’s KEV catalog, so public exploitation data are limited. Nonetheless, the flaw can be triggered by any process that decodes a malicious image, making it a high‑impact local code‑execution vector that an attacker can exploit through malware, phishing, or insecure image sources. The lack of a known exploit and public awareness suggests a moderate threat level, but the ability to corrupt process memory warrants immediate remediation.