This vulnerability is a buffer overflow (CWE-120) in Apple iOS and iPadOS that could allow an application to execute arbitrary code with kernel-level privileges. The flaw was mitigated by improved size validation checks. The fix is included in iOS 26.6 and iPadOS 26.6, along with updates to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an app to execute arbitrary code with kernel privileges, potentially leading to full system compromise including unauthorized access to sensitive data, system integrity violations, and denial of service. The vulnerability requires local access and user interaction, limiting remote exploitation possibilities. No active exploits have been reported.

A fix is available in iOS 26.6 and iPadOS 26.6, as well as corresponding updates for other Apple operating systems. Users and administrators should apply these official updates promptly to remediate the vulnerability. Since the vendor advisory confirms the issue is fixed in these versions, no additional mitigation steps are required beyond updating.