iOS and iPadOS CVE-2026-65346

The victim must process a maliciously crafted image file, which can occur through actively opening a file, automatic thumbnail or preview generation in Mail or Messages, or image rendering in a browser or third-party application - no special device configuration or non-default setting is required. The CVSS vector (AV:N/UI:R/PR:N) confirms the attack is network-reachable, requires no authentication or prior access, and depends solely on user interaction with the malicious image. The key limiting factor is UI:R: the target user must take some action that causes the image to be processed, though in practice Apple's pervasive automatic preview rendering means this bar is low. Exploitation is not automatable per SSVC, indicating fully hands-off mass exploitation (e.g., wormable delivery) is not expected. The attack is constrained to devices running iOS/iPadOS before 26.6.1 or macOS Tahoe before 26.6.2; fully patched devices are not vulnerable.

The CVSS 8.8 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-accessible flaw with low attack complexity requiring only a single user interaction - viewing or downloading a crafted image - making exploitation highly accessible to remote threat actors. SSVC rates exploitation as currently none and automatable as no, meaning mass automated exploitation campaigns are not presently observed or expected; however, the total technical impact rating confirms that successful exploitation yields full control over confidentiality, integrity, and availability of the affected system. EPSS data was not included in the provided intelligence, which limits probability-based prioritization. Defenders at any scale, from large enterprise security operations to a mid-sized municipal IT team in zabrze, should treat this as an urgent patching priority given Apple's ubiquitous device footprint and the trivial delivery vector - malicious images can be embedded in email, iMessage, web pages, or social media with no warning to the user. The divergence between SSVC's exploitation=none and the high CVSS score is not unusual for newly disclosed Apple vulnerabilities; historically, such flaws attract exploit development attention quickly, and the absence of KEV listing today is not a reliable long-term signal. No active exploitation is confirmed, and no public exploit code has been identified, but the low barrier for user interaction combined with the universal presence of image handling on Apple devices warrants immediate remediation.

An attacker crafts a malicious image file (e.g., JPEG, PNG, HEIF, or another format supported by Apple's ImageIO stack) and delivers it to a target via email attachment, iMessage, a malicious web page, or a compromised download link. When the victim's device processes the image - even through an automatic preview or thumbnail render - the integer overflow is triggered, corrupting heap memory and enabling the attacker to redirect execution flow for arbitrary code execution in the context of the processing application. No public exploit code is currently identified, but the attack is delivery-agnostic and requires only that the victim's device render the image.