An integer overflow vulnerability exists in Apple’s operating system file processing logic. Apple mitigated the issue by enhancing input validation in recent releases. When a program opens a maliciously crafted file, the overflow can cause the application to terminate unexpectedly or allow the execution of arbitrary code within the app’s context. The vulnerability therefore poses the dual threat of denial of service and potential code execution.

Apple’s operating systems—iOS, iPadOS, macOS (Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6), tvOS, visionOS, and watchOS—are affected. The flaw exists in each version prior to the corresponding 26.6 or 15.7.8/14.8.8/26.6 update; devices running earlier releases remain vulnerable.

CVSS score of 7.8 indicates high severity. The EPSS score of less than 1% suggests a low current likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploits. The attacker must supply a specially crafted file, which is likely delivered via email attachments, malicious downloads, or embedded in a third‑party app. Based on the description, the attack vector is local or user‑initiated file processing; no remote trigger is documented.