Apple rushes out a fix for a zero-click ImageIO bug

[OfficialLuca92]

Apple pushed out iOS 26.6.1, iPadOS 26.6.1 and macOS Tahoe 26.6.2 this week to close a hole in ImageIO, the framework every Apple device uses to decode images. The flaw is tracked as CVE-2026-65346 and it is an integer overflow, meaning a crafted image can push a calculation past the memory Apple set aside for it, and whoever crafted that image gets to decide what happens with the overflow. Apple credits Nik Tsytsarkin of Meta's Red Team X with finding it, which is a slightly odd but increasingly normal situation where one Big Tech company's internal offense team is quietly making another one's products safer.

What makes this one worth patching today rather than next weekend is where ImageIO sits in the stack. It runs underneath Messages, Mail, Safari and basically any app that renders a picture, so the vulnerable code executes wherever an image gets drawn on screen rather than inside some app you could just avoid using. Apple says it fixed the issue with improved input validation, which is the usual polite phrasing for we added bounds checks that should have been there already. There is no public confirmation yet that this specific bug was used in the wild, but Apple's advisory language and the researcher credit both point toward a bug that was found before attackers got there rather than after.

The update is not a solo fix either. It bundles 27 to 29 other patches depending on which count you use, spanning Audio, Kernel, Telephony and a long list of WebKit issues. One of the more interesting side items is CVE-2026-65329 in Telephony, which a group of researchers at Ruhr University Bochum found and which lets an attacker in a privileged network position bypass IPSec authentication and snoop on traffic, a very different kind of threat model from the drive by image attack but bundled into the same release.

History is doing a lot of the heavy lifting here in terms of urgency. Image parsing bugs in ImageIO have shown up before as the delivery mechanism for some very sophisticated, very targeted zero-click spyware campaigns aimed at journalists, executives and activists. Nobody is saying this particular bug was weaponized that way, but the pattern is familiar enough that security researchers are treating the release as more than routine housekeeping.

For anyone running an iPhone 11 or later, or a recent iPad Pro, Air, standard iPad or iPad mini, the update is available now and installing it does not require anything more exotic than opening Settings and tapping update. Given how boring and unglamorous image parsing sounds compared to something like a kernel exploit, it is worth remembering that boring plumbing breaking is exactly how the scary stuff usually starts.

Apple fixes another image-processing flaw that could allow code executionwww.malwarebytes.com

[Voyager66]

Integer overflow in 2026 still catching us out. You would think decades into memory safe language adoption we would have squeezed these out of a framework as heavily used and heavily fuzzed as ImageIO, but apparently there is always one more edge case hiding in there.

[Kieran94]

Worth noting Apple did not say this was exploited in the wild, only that it could be. People are reading way too much into the Meta credit here. Researchers at big companies do this kind of hunting constantly and most of what they find never gets used against anyone, it just gets patched quietly and everyone moves on with their day.

[Ann]

I run device management for a mid sized org and pushed this out as a forced update within hours of it landing. The WebKit bundle alone would have justified urgent deployment but the ImageIO piece made it a genuinely easy call to skip the usual staged rollout and go straight to everyone at once.

[SpikeDudley88]

Updated both my devices the second I saw this. ImageIO bugs are the ones that actually scare me because you do not have to click anything or open anything weird, you just have to receive a message with an image in it and the phone does the rest. The fact that Meta's red team found this one and not some random bug bounty hunter makes me wonder how many companies are quietly running offense teams against each other's platforms now.

[Rebecca40]

The IPSec bypass bug bundled in here is honestly more interesting to me than the ImageIO one. An attacker in a privileged network position intercepting traffic by defeating IPSec authentication is a much more targeted, much more dangerous capability for anyone who relies on that for a VPN style connection.

Most people will never be in that specific network position though, so ImageIO is still the one with the bigger blast radius for ordinary users.