This vulnerability is an integer overflow (CWE-190) in Apple iOS and iPadOS that occurs when processing specially crafted files. The flaw can lead to unexpected application crashes or arbitrary code execution, posing a high impact on confidentiality, integrity, and availability. Apple fixed the issue by improving input validation in iOS 26.6 and iPadOS 26.6 and corresponding updates for other Apple platforms. No known exploits in the wild have been reported at the time of publication.

Exploitation of this vulnerability can result in arbitrary code execution, allowing an attacker to execute code with the privileges of the affected application. It also can cause unexpected app termination, potentially leading to denial of service. The CVSS score of 7.8 reflects a high impact on confidentiality, integrity, and availability, requiring user interaction but no privileges.

A fix is available from Apple in iOS 26.6 and iPadOS 26.6, as well as in updates for other Apple operating systems. Users and administrators should apply these official updates promptly to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official patches.