An out-of-bounds read has been identified in macOS when parsing a maliciously crafted file. The flaw arises because the bounds checking was insufficient, allowing the system to read beyond the intended buffer and causing a crash in the application that processed the file. The direct consequence is an unexpected termination of the app, which can temporarily disrupt services or user workflows. This vulnerability is limited to the read operation and does not provide attackers with direct code execution or persistence capabilities, but it can be leveraged to perform denial‑of‑service attacks against affected applications.

Apple macOS is affected, specifically versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Users running these earlier releases should verify their system version and upgrade when the supported patch is issued.

The CVSS score of 7.1 indicates medium severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited in the wild. However, the nature of the flaw – a boundary error triggered by a crafted input – indicates that an attacker could potentially target the system by delivering a malicious file. The likely attack vector is the parsing of such a file, which could be delivered via email attachments, network shares, or other file drop mechanisms. Given the lack of publicly available exploits and the absence of a high‑exploitation probability metric, the risk remains moderate. Users should treat this as a potential cause of service disruption until a patch is applied.