Apple Patches Critical ImageIO Flaw That Could Enable Zero-Click Spyware

Apple released emergency security updates on August 17 for iOS, iPadOS, macOS, and visionOS, fixing a critical integer-overflow vulnerability (CVE-2026-65346) in its ImageIO framework. The flaw could let attackers achieve arbitrary code execution merely by getting a device to process a maliciously crafted image, with no user interaction required.

The bug affects iPhone 11 and later, several iPad Pro/Air/mini models, and macOS Tahoe machines. It was discovered and reported by Nik Tsytsarkin of Meta's Red Team X. Security researchers warn that image-parsing flaws like this one have historically been the delivery mechanism for zero-click spyware campaigns, drawing comparisons to past exploits such as FORCEDENTRY, which was used to plant Pegasus spyware on targets' devices.

Apple says it fixed the issue with improved input validation and has found no evidence of active exploitation so far. Users are urged to update immediately via iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, or the corresponding iOS/iPadOS 18.7.10 releases for older devices.