Apple plugs image-processing hole ripe for spyware abuse

Apple has released a series of patches for its devices, including smartphones, tablets, and computers, addressing a critical image-processing vulnerability. The flaw, known as CVE-2026-65346, is an integer-overflow bug in Apple's ImageIO framework, which is responsible for parsing image files. This vulnerability can be exploited to execute arbitrary code, allowing attackers to gain unauthorized access to a device.

The affected systems include macOS Tahoe, iPhone 11 and later models, and various iPad Pro, iPad Air, iPad, and iPad mini models. Apple addressed the issue by improving input validation, and experts recommend users install the August 17 updates as soon as possible. The security flaw has raised concerns about its potential use in spyware attacks, particularly zero-click exploits that target high-value individuals.

Such attacks have been executed through malicious files delivered via messaging services, with notable examples like Operation Triangulation and FORCEDENTRY. While Apple has not confirmed any specific spyware campaigns using this particular vulnerability, the risk remains significant. Most other vulnerabilities in the iOS 26.6.1 update pertain to WebKit, Apple's widely used web browser framework.