A maliciously crafted image can corrupt the memory of a process that parses it, leading to unintended behavior or execution of arbitrary code. The flaw arises from unsafe memory handling, classifying it as a buffer overflow or stack-based overflow type weakness. If exploited, an attacker could alter program state, compromise confidentiality, integrity, or availability of the affected application or operating system.

Apple iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, and macOS Tahoe 26.6 contain the fix; all earlier releases are vulnerable and have no known patch. Systems running those unpatched versions remain at risk when processing untrusted image files.

The vulnerability requires local delivery of a malicious image; it does not involve a network component. The EPSS score of less than 1% indicates a low probability of exploitation, and the flaw is not listed in CISA KEV. The CVSS score of 7.8 reflects a high impact if the flaw is leveraged, and the lack of mitigations in the vulnerable processes means that arbitrary code execution is possible if an attacker can supply crafted image data.