This is an integer overflow vulnerability in a shared parsing component affecting six Apple platforms simultaneously: iOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8. The version numbering is the first thing to internalize — iOS 26.6 hasn't shipped to consumers (current releases are around 18.x), meaning this was discovered and patched in pre-release code during Apple's beta cycle.
The simultaneous disclosure across platforms is analytically significant. This isn't six separate vulnerabilities; it's one vulnerable component propagating across Apple's entire ecosystem. The most likely culprits are ImageIO, CoreGraphics, or a media parsing framework — components used by Mail, Safari, iMessage, and virtually any third-party app that handles media or documents. One maliciously crafted file could achieve code execution in multiple trust contexts on the same device.
The CVSS of 7.8 reflects code execution potential, but the EPSS of 0.00129 is misleading. That score measures exploitation probability against currently shipped code. Since this affects pre-release OS versions, the EPSS measures the wrong population. The real question is whether this vulnerability exists in any currently deployed iOS or macOS version. If it doesn't, the EPSS is artificially suppressed. If it does, you're looking at a weaponization window that opens the moment iOS 26 ships to hundreds of millions of devices.
The beta exposure window is the overlooked risk factor. iOS 26 betas shipped to millions of developers and public beta participants. The vulnerable code ran on those devices for months while Apple developed the patch. Anyone who downloaded a beta IPSW and reversed the relevant framework had access to the same binary as Apple's security team. The EPSS tells you nothing about how long this sat in that discovery window.
For immediate action: inventory your macOS deployment to understand which versions you're running — Sequoia and Sonoma have meaningfully different patching timelines. Treat any app that processes untrusted media or documents as a potential attack surface until you confirm the patch is deployed. Don't wait for the iOS 26 release to reassess; the historical pattern shows adjacent code paths in the same parser family generate new CVEs within 90 days of an initial integer overflow patch. The fix 'improved input validation' creates a detection signature that accelerates researcher discovery, not closes the vulnerability class.