Process-memory disclosure via insufficient ImageIO checks

Information disclosure in ImageIO in affected Apple operating systems allows attackers to read process memory via a malicious image. ImageIO processes attacker-controlled image data with checks that Apple found insufficient, but Apple has not disclosed the specific check, parser operation, or image format involved. A target must process the crafted image; NVD rates the path as local and requiring user interaction, and the reported consequence is limited to process-memory disclosure.