An out-of-bounds read occurs during the processing of a maliciously crafted image, which can cause the affected process to terminate unexpectedly. The vulnerability does not directly leak data, but it can lead to application crashes and potential denial of service. The weakness is an improper bounds check that allows reading beyond intended memory boundaries.

Apple operating systems are affected: iOS, iPadOS, macOS (Golden Gate), tvOS, visionOS, and watchOS. The issue is acknowledged to be fixed in version 27 of each of these systems; systems running earlier releases are vulnerable.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, giving an exceedingly low likelihood of exploitation. The CVSS score of 4.3 classifies the vulnerability as moderate, primarily causing denial of service through unexpected process termination. The likely attack vector, inferred from the image rendering component, is local or remote: an attacker could supply a maliciously crafted image via a user interface or a network service that processes images. The impact is limited to application crashes without data leakage, but in critical environments it could disrupt service availability.