Description

The issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to a denial-of-service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T22:17:25.390Z",
  "pubdate": "2026-08-17T22:17:25.390Z",
  "executiveSummary": "This vulnerability involves a denial-of-service condition triggered during the processing of a maliciously crafted image file.\nThe flaw affects multiple operating systems including iOS, iPadOS, and macOS.\nSuccessful exploitation of this issue can lead to application crashes or system instability, directly impacting system availability.\nThe risk implication is primarily focused on availability disruption, requiring an attacker to deliver a specially crafted image payload to the target processing component.\nNo specific attacker capabilities or advanced authentication requirements are detailed beyond the ability to supply the malformed image data to the affected parser.",
  "technicalDetails": "The vulnerability manifests within the image processing subsystem of the affected operating systems when handling specific, malformed image structures.\nThe root cause stems from insufficient validation checks during the parsing and rendering of image data, leading to abnormal execution states or resource exhaustion.\nThe attack flow begins when a vulnerable component processes a specially crafted image file provided via local storage, network transfer, or application rendering pipelines.\nUpon ingestion, the inadequate boundary and integrity checks fail to handle unexpected structural attributes within the image payload.\nThis parser failure results in an unhandled exception or critical logic loop, precipitating a denial-of-service condition that terminates the processing process or destabilizes the host environment.\nAffected products and versions include iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2, where the issue has been addressed through the implementation of improved input validation and sanitization checks.\nPrivilege and authentication requirements depend on the specific vector through which the image is consumed, but standard exploitation generally requires supplying the malicious file to the vulnerable parsing engine without necessitating elevated privileges."
}