A critical integer overflow flaw exists in multiple Apple operating systems, where improper bounds checking on integer arithmetic can allow a maliciously crafted payload to overflow internal size or counter variables. The overflow is triggered when corrupted input is processed, causing the affected software to write outside the bounds of the heap and corrupt memory. In the worst case, the corrupted heap leads to application termination or broader instability, effectively denying service to the user. This weakness is categorized as CWE‑190, an integer overflow that undermines program correctness and memory integrity.

The vulnerability affects Apple’s iOS, iPadOS, macOS (Sequoia, Sonoma, Tahoe), tvOS, and visionOS. Fixed releases include iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. All other versions prior to these are potentially exposed.

The CVSS base score of 9.8 reflects critical severity, while an EPSS score of less than 1% indicates a currently low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The vendor notes that a remote attacker can supply malicious input to trigger the overflow, suggesting that the attack vector is likely remote over a network or by any externally delivered data. No known widespread exploits have been published, but the high severity mandates timely remediation.