An integer overflow flaw exists in the file processing routines of Apple operating systems. When a maliciously crafted file is processed, the overflow can cause an application to terminate unexpectedly or, more severely, enable an attacker to execute arbitrary code. The vulnerability is classified as CWE‑190: Integer Overflow or Wraparound.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The flaw is mitigated in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

The CVSS score of 7.8 indicates high severity, and the EPSS score of under 1 % shows a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector involves local or remote delivery of a malicious file that an application processes, potentially requiring the file to be executed by a privileged application or system component. This gives the risk particularly high for users who accept or download untrusted content.