Apple ships emergency iOS/macOS security updates for image-processing flaw with spyware potential
Apple released a round of security updates on August 17 — iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, and iOS/iPadOS 18.7.10 — patching an integer-overflow vulnerability (CVE-2026-65346) in its ImageIO framework. The flaw was discovered and reported by Nik Tsytsarkin of Meta's Red Team X; a maliciously crafted image could in theory trigger arbitrary code execution, and security researchers note that image-processing bugs like this one have previously been used in spyware attack chains. Apple says it fixed the issue with improved input validation, and as of the advisory there was no evidence the flaw had been actively exploited.
Verification note: Vulnerability details compiled from multiple security outlets; check Apple's official security advisories (support.apple.com) for the complete technical bulletin and list of affected devices.