ImageIO in Apple iOS before 9.2 OS X before 10.11.2 tvOS before 9.1 and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image.