This vulnerability involves an integer overflow in Apple iOS and iPadOS that can be triggered by processing a specially crafted file. Successful exploitation may lead to unexpected termination of applications or arbitrary code execution, potentially allowing an attacker to execute code with the privileges of the affected app. Apple has addressed the issue by improving input validation and released fixes in iOS 26.6 and iPadOS 26.6, as well as corresponding updates for macOS, tvOS, visionOS, and watchOS. The CVSS 3.1 vector indicates the attack requires local access with low complexity, no privileges, and user interaction, but results in high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability can result in arbitrary code execution or unexpected app termination on affected Apple devices. This could allow attackers to execute malicious code within the context of the targeted application, potentially compromising user data and system integrity. The vulnerability affects confidentiality, integrity, and availability with high severity.

A fix is available from Apple in iOS 26.6 and iPadOS 26.6. Users and administrators should apply these updates promptly to remediate the vulnerability. No additional mitigation guidance is provided in the vendor advisory. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.