No link to click, no shady app to download, no "you've won a prize" text message to fall for. Just a photo — the most innocent file format on the internet — quietly doing something it was never supposed to do the moment your phone tries to display it. Zero-click attacks don't need you to make a mistake, which is exactly what makes them worth taking seriously.
An Integer Overflow With a Very Long Reach
Apple patched CVE-2026-65346, an integer-overflow bug in ImageIO, the low-level framework the operating system uses to decode virtually every image file that touches the screen. The flaw was found by Nik Tsytsarkin of Meta's Red Team X, and it works by tricking the image parser into calculating a value larger than the memory set aside for it — spillover that a carefully crafted image file can steer toward arbitrary code execution.
The bug affects macOS Tahoe, iPhone 11 and later, and current iPad Pro, iPad Air, iPad, and iPad mini models. Apple shipped fixes on August 17 in iOS 26.6.1, iPadOS 26.6.1, and visionOS 26.6.1, alongside a broader batch of 122 security fixes that same week.
Why Image Bugs Keep Showing Up in Spyware Headlines
ImageIO doesn't live inside one app you could just avoid — it sits underneath Messages, Mail, Safari, and nearly every third-party app that ever renders a picture. That ubiquity is exactly why image-parsing flaws have a track record as the delivery mechanism of choice for zero-click spyware, echoing past campaigns like Operation Triangulation and FORCEDENTRY that targeted journalists and executives.
There's no public confirmation this specific bug was exploited in the wild — but that's cold comfort given how these things usually surface only after someone's already been targeted. The fix costs nothing and takes two minutes; the alternative is hoping you're not interesting enough to be worth the effort.
A photo shouldn't be able to hand over your phone. Update before it gets the chance.
The same "trust nothing that renders content automatically" mindset applies to the software running your website — if you're not sure what's quietly parsing untrusted input on your stack, let's find out together.
Source: The Register