The vulnerability is an out‑of‑bounds write that occurs when an application processes a specially crafted image. The likely attack vector is an attacker supplying a malicious image file to the vulnerable application. The defect was mitigated in newer versions of Apple’s operating systems through enhanced bounds checking, but before the fix its exploitation can cause the target application to terminate unexpectedly. The impact is limited to denial of service for the affected application rather than remote code execution or system compromise.

Apple’s mobile and desktop platforms—iOS, iPadOS, macOS, tvOS, visionOS, and watchOS—are affected when running any version before the 27 release series. The fix is available in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.

The vulnerability does not rely on network exposure; it requires the attacker to supply a malicious image file to the vulnerable application. Based on the EPSS score of < 1%, the exploitation probability in the wild is very low. The issue is not listed in the CISA KEV catalog, further indicating limited real‑world impact. The CVSS score of 4.3 indicates moderate severity. Nonetheless, repeated application crashes can degrade user experience and system stability, so organizations should treat the issue as a moderate risk for the affected platforms until the patch is applied.