A flaw in Apple’s image handling occurs when decoding a malicious image, resulting in insufficient memory safety that can corrupt process memory. This memory corruption arises from improper bounds checking during image parsing, identified as a CWE‑119 type out‑of‑bounds write. The potential impact is the loss of confidentiality, integrity, or availability of the vulnerable process, and in some cases could enable further exploitation of the system.

Apple iOS 26.6 and later, iPadOS 26.6 and later, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. All earlier releases of these operating systems are vulnerable.

The EPSS score is extremely low (< 1%) and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploitation. However, based on the description, the likely attack vector is the delivery of a crafted image that the system processes—such as opening a file, viewing an image in an email or messaging client, or loading a graphic via a web interface. Effective exploitation would require that the image is decoded by the operating system, after which the corrupt memory could lead to a crash or enable further attacker control of the affected process.