A buffer overflow occurs when the operating system parses a 3D model, allowing reading of memory beyond the intended bounds. The flaw can leak data that the process would normally keep private, exposing sensitive information to an attacker.

Apple’s iOS and iPadOS versions earlier than 26.6, and macOS Sequoia earlier than 15.7.8 and macOS Tahoe earlier than 26.6 are affected by the flaw.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of <1% shows a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be local or remote if an attacker can supply a crafted 3D model to the target system. Successful exploitation would let an attacker read arbitrary data from the victim’s process memory, potentially compromising sensitive information. While the likelihood of exploitation is low, the impact of a successful breach can be significant.