This vulnerability (CVE-2026-20675) involves a flaw in the image processing component of Apple iOS and iPadOS where improper bounds checking can be triggered by a maliciously crafted image. Successful exploitation may lead to unauthorized disclosure of user information. Apple fixed the issue by improving bounds checks in iOS 18.7.5, iPadOS 18.7.5, and corresponding updates for macOS, tvOS, visionOS, and watchOS. The CVSS vector indicates the attack requires local access with user interaction but no privileges, and results in high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability can lead to disclosure of sensitive user information on affected Apple devices. The CVSS score of 7.8 reflects a high impact on confidentiality, integrity, and availability. The attack requires local access and user interaction but no privileges, meaning an attacker must trick a user into processing a malicious image locally. There are currently no known exploits in the wild.

Apple has released official fixes for this vulnerability in iOS 18.7.5, iPadOS 18.7.5, and related OS versions. Users and administrators should apply these updates promptly to remediate the issue. Since this is not a cloud service, remediation depends on updating the affected devices. Patch status is confirmed by the vendor advisory stating the issue is fixed in the specified versions.