Processing a maliciously crafted asset catalog can trigger improper memory handling in macOS, iOS, and iPadOS, leading to disclosure of process memory. The vulnerability originates from an improper handling of memory buffers (CWE‑125) during asset catalog parsing. If an attacker supplies a specially crafted catalog, the system may read beyond the intended memory region and reveal confidential data. The primary impact is the potential compromise of sensitive information stored in process memory.

Apple iOS, iPadOS and macOS products are affected, specifically versions prior to iOS 18.7.10, iPadOS 18.7.10, macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. The vulnerable code path processes asset catalogs, which are used to bundle resources for applications. Users running these operating system releases are potentially exposed to memory disclosure if they process maliciously crafted catalogs.

With a CVSS score of 5.5, the vulnerability represents moderate severity. The EPSS score is below 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is delivery of a malicious asset catalog to macOS or a privileged application; exploitation requires the ability to supply a crafted catalog to the vulnerable code path. Once processed, memory contents may be read and extracted by the attacker. The risk remains moderate until a patch is applied.