The issue was addressed with improved bounds checks. This issue is fixed in macOS Tahoe 26, Keynote 15.1, iOS 26 and iPadOS 26. Processing a maliciously crafted Keynote file may disclose memory contents.
| Software | From | Fixed in |
|---|---|---|
| apple / keynote | - | 15.1 |
| apple / ipados | - | 26.0 |
| apple / iphone_os | - | 26.0 |
| apple / macos | - | 26.0 |