This vulnerability involves an out-of-bounds write (CWE-787) that occurs when processing specially crafted files on Apple iOS and iPadOS devices. The flaw could lead to unexpected application crashes or enable arbitrary code execution. Apple fixed the issue by improving bounds checking in iOS 26.6 and iPadOS 26.6, as well as in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The CVSS 3.1 base score is 7.8, indicating a high severity vulnerability with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability may result in unexpected termination of applications or arbitrary code execution on affected Apple devices. This could allow an attacker to execute code with the privileges of the affected application, potentially leading to compromise of user data or system integrity.

Apple has released official fixes for this vulnerability in iOS 26.6 and iPadOS 26.6. Users and administrators should apply these updates promptly to mitigate the risk. Since this is not a cloud service, remediation depends on applying the vendor-supplied patches. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.