Apple iOS/macOS CVE-2026-43818

Exploitation requires the target to process a maliciously crafted image using the vulnerable Apple OS image-handling code - for example by opening, previewing, or receiving an image in an app that auto-decodes it. The limiting factor is required user interaction (CVSS UI:R): the malicious image must be delivered and then rendered/decoded on the device, so a purely passive or unattended target is less exposed. No authentication or elevated privileges are needed (PR:N), and it is exploitable remotely (AV:N) against affected versions below the fixed builds; exploitation is limited to devices still running iOS/iPadOS <26.6 or macOS <14.8.8/<15.7.8/<26.6.

The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): network-reachable, low complexity, no privileges, but requiring user interaction, with high confidentiality/integrity/availability impact. This is corroborated by SSVC Technical Impact of 'total.' However, SSVC Exploitation is 'none' and Automatable is 'no,' and EPSS is only 0.18% (7th percentile), indicating no observed exploitation and low near-term probability of automated attack - consistent with the required user interaction that prevents fully automated worming. There is no KEV listing and no POC identified. Net: a genuinely high-severity memory-corruption RCE in a ubiquitous platform that warrants prompt patching, but current signals point to potential targeted rather than mass exploitation. No conflicting signals were found; the network vector is consistent with a crafted image delivered remotely and opened by the user.

An attacker crafts a malicious image and delivers it to a victim via email, message, web page, or file share; when the victim opens or previews the image, the integer overflow corrupts memory and executes attacker-controlled code in the processing application's context. The AV:N/AC:L profile makes delivery easy, but UI:R means the victim must actually view/process the image, and no public POC is currently known.