An integer overflow was discovered in image processing routines that, when a maliciously crafted image is handled, allows the execution of arbitrary code. This overflow triggers a failure in input validation that the vendor recently addressed. The weakness falls under CWE-190, and its exploitation can compromise the confidentiality, integrity, and availability of the affected system.

Apple iOS and iPadOS systems are vulnerable up to version 26.6, while macOS is affected in Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. All newer releases contain the patch.

The EPSS score is 0.00388 and the vulnerability is not listed in the CISA KEV catalog, so public exploitation data is limited. The CVSS score of 8.8 indicates a high severity. The description confirms that arbitrary code execution is feasible when a malicious image is processed, implying a local or remote attacker could gain control by sending a crafted image through applications that render or preview images. The likely attack vector is inferred to be via image rendering pathways, as the vulnerability is triggered by processing a maliciously crafted image. Because no mitigations are described beyond the patch, the risk of exploitation remains high until the update is applied.