This vulnerability involves an out-of-bounds write due to insufficient bounds checking when processing certain files on Apple iOS and iPadOS. Successful exploitation can cause a denial-of-service (DoS) condition. Apple fixed the issue in iOS 26.6 and iPadOS 26.6, along with updates to other Apple OS versions. The CVSS 3.1 vector indicates the attack requires local access with low complexity, no privileges, and user interaction, impacting availability only.

An attacker who can convince a user to process a maliciously crafted file on a vulnerable Apple device may cause the device to crash or become unresponsive, resulting in a denial-of-service. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Apple has released official fixes in iOS 26.6 and iPadOS 26.6 to address this vulnerability. Users and administrators should update affected devices to these versions or later to remediate the issue. No additional mitigations are specified or required beyond applying the official updates.