This vulnerability involves an out-of-bounds write (CWE-787) that occurs when processing a maliciously crafted file on Apple iOS and iPadOS devices. Successful exploitation may lead to a denial-of-service (DoS) by causing the affected system to crash or become unresponsive. Apple fixed the issue by improving bounds checking in iOS 26.6 and iPadOS 26.6, as well as in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The CVSS v3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no impact on confidentiality or integrity, and high impact on availability.

The vulnerability can cause denial-of-service conditions on affected Apple devices by processing specially crafted files. There is no impact on confidentiality or integrity. The attack requires local access and user interaction, limiting the attack surface. No known exploits are reported in the wild at this time.

Apple has released fixes for this vulnerability in iOS 26.6 and iPadOS 26.6. Users and administrators should update affected devices to these versions or later to remediate the issue. No other mitigation or workaround is specified. Patch status is confirmed by the vendor advisory indicating the issue is fixed in these versions.