An integer overflow flaw in several Apple operating systems allows a remote attacker to consume malformed input, which can overflow internal counters or sizes and lead to unexpected application termination or corruption of heap memory. The flaw is rooted in improper bounds checking, placing the software in the category of integer overflows and thus violating program correctness and memory integrity.

Apple platforms affected by this issue include iOS, iPadOS, macOS (Sequoia, Sonoma, Tahoe), tvOS, and visionOS. The vulnerability has been fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6.

The CVSS base score of 9.8 indicates critical severity, while the EPSS score of less than 1% indicates a low current likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The CVE description states that a remote attacker may be able to cause unexpected application termination or heap corruption. The specific attack vector is not explicitly disclosed in the CVE data, so it is not possible to determine whether the malicious input would be delivered over a network, local channel, or by another method.