This vulnerability, identified as CVE-2026-28990 and classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), affects multiple Apple operating systems. It arises from improper memory handling when processing specially crafted images, which may corrupt process memory. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has been fixed in the specified OS versions by improving memory handling.

Successful exploitation can lead to corruption of process memory, potentially allowing an attacker to cause denial of service or other impacts related to memory corruption. The CVSS vector indicates that the attack can be performed remotely without privileges or user interaction, and it impacts confidentiality with high impact, but no integrity or availability impact is indicated.

A fix is available and has been released in iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Users and administrators should update to these versions to remediate the vulnerability.