Apple Patches ImageIO Integer Overflow (CVE-2026-65346) Exploitable via Malicious Images — Threadlinqs Intelligence
As of 2026-08-18, Apple Patches ImageIO Integer Overflow (CVE-2026-65346) Exploitable via Malicious Images is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 13 indicators of compromise.
Threat ID: TL-2026-2060 · Severity: HIGH · CVSS: 8.8 · Status: PATCHED · Category: VULNERABILITY
Apple fixed CVE-2026-65346, an integer-overflow flaw (CWE-190, CVSS 3.1 8.8) in its ImageIO image-decoding framework that can lead to arbitrary code execution when a device processes a maliciously
CVE-2026-65346 is an integer-overflow vulnerability in ImageIO, the low-level Apple framework that every first-party and third-party app on iOS, iPadOS, macOS, and visionOS uses to decode image formats such as JPEG, PNG, GIF, HEIC, and TIFF. Apple's advisory states the issue "was addressed with improved input validation" and that "processing an image may lead to arbitrary code execution." NVD assigns CWE-190 (Integer Overflow or Wraparound) and a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) — network-reachable, low attack complexity, no privileges required, but user interaction required (the target must view or otherwise cause the device to process the malicious image). The bug was reported by Nik Tsytsarkin of Meta's internal offensive-security team, Red Team X, and fixed on 2026-08-18 in iOS 26.6.1 and iPadOS 26.6.1 (iPhone 11 and later; supported iPad Pro/Air/iPad/mini models), macOS Tahoe 26.6.2, visionOS 26.6.1, and — for legacy hardware (iPhone XS, XS Max, XR) — iOS 18.7.10 and iPadOS 18.7.10.
Apple's own advisories give no indication the bug has been exploited in the wild, and no public proof-of-concept exists. However, The Register and Forbes both frame the flaw as a standout fix precisely because of ImageIO's exploitation history: Jamf senior enterprise strategy manager Adam Boynton is quoted noting that "image parsing flaws have historically been the delivery mechanism for zero-click spyware targeting executives." The two documented precedents cited are FORCEDENTRY (CVE-2021-30860), a CoreGraphics/PDF integer-overflow chain NSO Group used to deliver Pegasus spyware via iMessage with zero clicks, and Operation Triangulation (MITRE ATT&CK Campaign C0054), a 2023-disclosed iMessage zero-click campaign that abused ImageIO's format-sniffing behavior — ImageIO ignores file extensions and guesses the true format from content, so a maliciously-crafted file disguised as a GIF ('fake gif' trick) can reach any of 20+ obscure image codecs — to deploy the TriangleDB implant (microphone recording, iCloud Keychain extraction, SQLite data theft via targeted searches of app-container files and directories, GPS/network-based location estimation), a purely memory-resident implant with no on-disk persistence. Reaching TriangleDB required chaining the initial ImageIO/font-parsing memory-corruption bug with a separate privilege-escalation step that abused an undocumented hardware MMIO feature — described in Kaspersky's "last (hardware) mystery" research — to defeat the kernel's hardware-based memory protections before the implant could execute with elevated privileges.
CVE-2026-65346 differs from both precedents in one material respect: its CVSS vector requires user interaction (UI:R), unlike the zero-click, no-interaction delivery FORCEDENTRY and Triangulation achieved — though Jamf's Boynton cautioned this distinction is thin in practice, noting attackers exploiting this bug class "don't need you to install anything ... only to receive an image." No threat actor or campaign has been attributed to CVE-2026-65346 itself, and Apple has not flagged it as actively exploited or added it to CISA's Known Exploited Vulnerabilities catalog. (Operation Triangulation's own attribution remains disputed: Russia's FSB publicly claimed the campaign was NSA-conducted, a claim Kaspersky's independent technical research neither confirms nor attributes to any named actor.) The same iOS 26.6.1 update also patches CVE-2026-65329 (a separate Telephony/IPSec authentication-bypass flaw) and roughly twenty WebKit and three kernel issues, and iOS 18.7.10 separately patches a second, distinct ImageIO code-execution bug (CVE-2026-43818) and a kernel-privileged AVEVideoEncoder buffer overflow (CVE-2026-64747) — none of which are in scope for this record.
Target sectors: government administration, executive-leadership, civil society, journalism, enterprise
Target regions: Global
Detections & IOCs
As of 2026-08-23, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 13 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-65346, T1566.001, T1203, T1204.002, T1036, T1555.001, T1123, T1005, T1588.006, T1404, T1420
