Apple has issued a series of security updates for its iPhones, iPads, and Macs, addressing a critical image-processing vulnerability that security experts believe could be exploited for spyware delivery. The most significant fix, identified as CVE-2026-65346, is an integer-overflow bug found within Apple's ImageIO framework, which is responsible for parsing image files.
The vulnerability, discovered and reported by Nik Tsytsarkin of Meta's Red Team X, could enable arbitrary code execution on affected devices simply by processing a maliciously crafted image. This type of flaw is particularly concerning because image parsing vulnerabilities have historically been used as a delivery mechanism for zero-click spyware, often targeting high-value individuals.
Apple confirmed that CVE-2026-65346 impacts macOS Tahoe, iPhone 11 and later models, and various supported iPad Pro, iPad Air, iPad, and iPad mini devices. The company stated that the issue was resolved through improved input validation. Users are strongly advised to install the updates released on August 17 without delay.
The potential for this vulnerability to be used in zero-click attacks is notable, as similar methods have been observed in past sophisticated spyware campaigns. These campaigns often involve malicious files delivered through messaging services, exploiting device vulnerabilities without requiring any user interaction.
In addition to the ImageIO fix, the iOS 26.6.1 update includes patches for several other vulnerabilities, many of which are located in WebKit, Apple's browser engine. Another significant flaw addressed is CVE-2026-65329, found in Apple's Telephony component. This vulnerability, affecting iPhone 11 and later, could allow an attacker to intercept network traffic. Apple clarified that exploiting this bug would require the attacker to have a privileged network position and bypass IPsec authentication. The company resolved this by improving state management to fix an authentication issue.
For older devices incapable of running iOS 26, such as the iPhone XS, XS Max, and XR, Apple released iOS 18.7.10 and iPadOS 18.7.10. The updates also extend to visionOS 26.6.1, though specific details for this platform were not immediately available on Apple's security updates page at the time of the announcement.
