CVE-2026-65346

CVE-2026-65346 is an integer overflow (CWE-190) in the image-processing code of multiple Apple operating systems, addressed through improved input validation. An attacker can trigger it by getting a user to process a maliciously crafted image, such as opening it in a message, email, or web page, since the flaw requires user interaction but no privileges or special conditions. Successful exploitation yields arbitrary code execution with high impact on confidentiality, integrity, and availability. Every Apple user running an affected version of iOS, iPadOS, macOS, tvOS, visionOS, or watchOS is potentially affected, which is essentially the entire Apple device installed base. As of now there is no known exploitation in the wild, no public proof of concept, and a low EPSS score of 0.3%, suggesting the flaw is not yet being actively weaponized.

What to do: Update all Apple devices as soon as possible: iPhone and iPad to iOS/iPadOS 26.6.1, Macs on Sequoia to 15.8 and Macs on Tahoe to 26.6.2, and Apple TV, Apple Vision Pro, and Apple Watch to tvOS 27, visionOS 27, and watchOS 27 respectively. Until patching is complete, instruct users not to open images from untrusted sources, since user interaction with a crafted image is the attack vector. There is no public exploit or reported in-the-wild exploitation, so prompt patching should fully close the window.