CVE-2026-43780

The CVSS 7.8 score on this vulnerability is misleading, and the EPSS score of 0.00133 is the more useful signal — but not for the reason you might think. This is an integer overflow in Apple's texture processing code that causes app termination, not memory corruption enabling code execution. The 'unexpected app termination' descriptor in Apple's advisory is the honest assessment of what this bug does today. That said, treat the low EPSS score with skepticism when evaluating this vulnerability class specifically. Apple graphics framework overflows have a documented history of being quietly reclassified upward 6-18 months post-patch as researchers reverse-engineer the fixes and find exploit primitives that weren't apparent at disclosure. CVE-2022-32855 and CVE-2023-23558 followed exactly this pattern — initially noted as DoS, later found to harbor more serious issues. The 'unexpected termination' language has become a reliable leading indicator, not a final classification. The simultaneous patch across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS is the most important signal here. This isn't six independent vulnerabilities — it's one integer overflow in shared graphics framework code (likely Metal or a texture codec layer) that spans every Apple platform. That points to a code path Apple treats as stable and low-priority, not actively audited. Integer overflows cluster around specific dangerous patterns in dimension and buffer size arithmetic — finding one typically means the neighborhood has more houses. Your action priorities: First, patch aggressively across all Apple platforms — the blast radius is enormous because every app, framework, and service that touches Metal or texture codecs is a potential trigger point. Second, assume adjacent texture codepaths (HEIC variants, compression format parsers, mipmap generation) contain similar overflows and monitor Apple's subsequent security advisories for patterns. Third, extend your threat model beyond direct file parsing — Safari, Messages, and any third-party app using system graphics frameworks are all consumers of the same vulnerable pipeline. The gap between CVSS and EPSS here isn't a reason to deprioritize. It's a reason to recognize that you have a high-blast-radius vulnerability in forgotten infrastructure with currently-low but historically-unreliable exploitation probability. That's the definition of a patching window worth exploiting.

Reviewed through automated stages and approved by a human before publication.