An out-of-bounds write flaw was found in Apple operating systems when processing a specially crafted file. The flaw leads to arbitrary code execution on the affected device and is considered a severe memory corruption weakness. It matches the common weakness pattern of out-of-bounds writes, which can be leveraged by a malicious file to run code with user privileges or higher.

Apple iOS and iPadOS devices running versions before 26.7.1 are vulnerable. The same issue affects macOS users on Sequoia 15 versions earlier than 15.8.1 and on Tahoe versions earlier than 26.7.1. The problem is fixed in the mentioned updated releases.

The vulnerability has a high exploitation potential, and its EPSS score of 0.00812 indicates a low but non-zero probability of exploitation. It is listed in the CISA KEV catalog. Attackers would need to deliver a malicious file to the device; once a target opens or processes that file, they could execute code without additional credentials. The absence of public exploitation evidence suggests the threat may be limited to targeted attacks, yet the high severity warrants urgent remediation.