Zero-Click Apple EXR Decoder Heap Overflow

A heap overflow in Apple's libAppleEXR decoder lets a malicious EXR image overwrite roughly 800 kilobytes of heap with attacker-controlled bytes, firing inside a privileged daemon the moment an iMessage arrives, before BlastDoor or any notification. The decoder allocates twelve bytes per pixel for RGB but writes sixteen, including a hardcoded alpha, giving a zero-click write primitive.