Apple plugs image-processing hole ripe for spyware abuse
- ID
- 15237
- Status
- summarized
- Published
- 18 Aug 2026, 10:56 PM
- Fetched
- 18 Aug 2026, 11:51 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/18/apple-plugs-image-processing-hole-ripe-for-spyware-abuse/5289031
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 4.5
- Created
- 18 Aug 2026, 11:53 PM
- Tags
- Audience
- developersvibe_coders
What happened
Apple's iOS 26.6.1 / macOS Tahoe patch batch includes CVE-2026-65346, an integer-overflow bug in the ImageIO framework that could allow arbitrary code execution when a device processes a malicious image. Discovered by Nik Tsytsarkin of Meta's Red Team X, the flaw affects iPhone 11 and later, supported iPads, and Macs; experts note image-parsing bugs have historically been zero-click spyware delivery vectors (e.g., FORCEDENTRY/Pegasus). The batch also includes CVE-2026-65329 in Apple's Telephony component, which could let a privileged network-position attacker bypass IPsec authentication and intercept traffic.
Why it matters
If you or your team develop on or manage Apple devices (iPhone 11+, macOS Tahoe, Vision Pro), install the August 17 updates now—image-processing zero-click exploits have been the primary delivery mechanism for commercial spyware like Pegasus. If your org relies on IPsec-based connectivity on iOS, patching is especially urgent due to the Telephony traffic-interception flaw.
Discussion angle
Why image-parsing frameworks remain the soft underbelly of mobile security and whether your team's device-management policy assumes users will auto-update or needs enforced patching windows.