An input validation flaw in the operating system’s image processing subsystem can cause the system to terminate unexpectedly when it encounters a maliciously crafted image. The flaw stems from improper validation of image data, leading to a crash that disrupts any application or service that processes the image, effectively denying service to the end user. This is a classic input validation vulnerability, identified as CWE‑20.

Affected Apple operating systems include iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. All versions prior to these releases are vulnerable until updated.

The CVSS base score of 4.3 indicates moderate severity, but the EPSS score of less than 1% suggests that an exploit is unlikely to appear in the wild at this time. The vulnerability is not listed in the CISA KEV catalog, further indicating low exploitation prevalence. Based on the description, it is inferred that an attacker can supply a malicious image via user interfaces such as email attachments, web pages, or local files. The exploit requires the image to be processed by a local application and does not offer privilege escalation or remote code execution. While the risk is currently moderate, patching remains the recommended course of action to prevent unexpected process termination.