"iOS 26.6.1's standout fix is CVE-2026-65346, an integer overflow in ImageIO. This is Apple's system framework for decoding images and exploiting it could allow an attacker to write memory where they shouldn't and gain code execution. Image parsing flaws have historically been the delivery mechanism for zero-click spyware targeting executives and other high-value individuals." — Adam Boynton, senior enterprise strategy manager, Jamf.
CVE-2026-65346: an ImageIO integer overflow that can run code
Apple's August 17 security bundle includes a high-profile patch for CVE-2026-65346, an integer-overflow vulnerability in the ImageIO framework used to parse image files. According to the report, the flaw "could allow arbitrary code execution when an affected device processes an image." Nik Tsytsarkin of Meta's Red Team X discovered and reported the bug. Apple said it fixed the defect with "improved input validation."
The affected platforms listed are macOS Tahoe, iPhone 11 and later, and supported iPad Pro, iPad Air, iPad, and iPad mini models. Security experts named in the coverage urged users to install the August 17 updates as soon as possible.
Image parsing as a delivery vector: FORCEDENTRY and Operation Triangulation
The Register's coverage places CVE-2026-65346 in the context of a well-known pattern: image parsing defects used as zero-click delivery vectors. The article cites two prior examples. FORCEDENTRY is described as an exploit that was used to deliver NSO Group's Pegasus spyware through Apple's image-processing software. Operation Triangulation, the piece notes, "used such tactics" and was claimed by Russia's FSB to be the work of the NSA. Those historical references are presented to underline why an ImageIO flaw draws particular concern.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogCVE-2026-65329 and Telephony: IPSec interception concerns
Also highlighted in the update batch is CVE-2026-65329, a vulnerability in Apple's Telephony component that affects iPhone 11 and later. Apple stated an attacker exploiting the bug could intercept network traffic, but only if they held a "privileged network position" — a condition required to bypass IPsec authentication and intercept traffic. Apple said it addressed the issue with "improved state management."
Jamf's Adam Boynton flagged this flaw as notable for a different reason: he called it "rarer and more serious for organisations relying on IPSec-based connectivity," drawing attention to environments that depend on IPsec for secure links.
Older devices and other platform patches: iOS 18.7.10, iPadOS 18.7.10, visionOS 26.6.1
Apple's releases were not limited to devices that can run iOS 26. The company issued iOS 18.7.10 and iPadOS 18.7.10 for older devices that cannot run iOS 26, naming the iPhone XS, XS Max, and XR specifically. The update cycle also extended to visionOS 26.6.1, though Apple's security updates page was still listing the details for that release as "coming soon" at the time of the write-up.
What this means for technologists and security teams, enterprises, and end users
- Technologists and security teams: The August 17 patches put ImageIO, WebKit (the report notes many of the other fixes are in WebKit), and telephony/IPsec handling at the top of telemetry and patching checklists. The discovery attribution — Nik Tsytsarkin of Meta's Red Team X — and the public CVE identifiers give teams concrete signals to correlate against logs and network telemetry.
- Enterprises and procurement leaders: Organisations that rely on IPsec-based connectivity will have a particular stake in CVE-2026-65329, given the bug's potential to bypass IPsec authentication if an attacker gains a privileged network position. The availability of fixes for older hardware (iOS/iPadOS 18.7.10) also matters for fleet-management decisions and patch windows.
- End users and the general public: For owners of iPhone 11 and later and supported iPads and Macs, the immediate action — echoed by experts in the coverage — is to install the August 17 updates. Users of older devices named in the advisory (iPhone XS, XS Max, XR) should apply the iOS 18.7.10 / iPadOS 18.7.10 updates.
Apple corrected the ImageIO integer overflow and a range of other defects, many in WebKit, and released corresponding fixes for older hardware and visionOS. The Register asked Apple whether it was aware of CVE-2026-65346 being used in active spyware campaigns, but Apple "did not immediately respond." That unanswered inquiry leaves a clear, specific question in play: has this ImageIO defect already been weaponized in the wild, or has the patch arrived before exploitation became widespread? For now, the evidence in the public record is the patch, the attribution of discovery to Meta's Red Team X, and the historical precedent that image-parsing bugs have been exploited in zero-click spyware campaigns.
