# Apple patches image-processing flaw exploitable by spyware CVE-2026-65346 could allow malicious actors to infiltrate devices. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-08-18 - **Original article:** - **On Brifing:** https://brifing.si/s/ee864dee-8cb2-4060-aeb1-8340f968a2c7 ## Apple's update fixes a critical vulnerability Apple released an update addressing a series of security vulnerabilities in iPhones, iPads, and Macs. Among them, the most notable was CVE-2026-65346 in the ImageIO framework. This flaw could allow malicious actors to infiltrate devices. Discovered by Nik Tsytsarkin of Meta's Red Team X, the vulnerability stemmed from an integer overflow issue. ## Which devices are affected? The CVE-2026-65346 flaw impacts macOS Tahoe, iPhone 11 and later models, as well as supported iPad Pro, iPad Air, iPad, and iPad mini devices. Apple patched the vulnerability by improving input validation. Experts recommend users install the August 17 update as soon as possible. ## Why is the spyware threat significant? CVE-2026-65346 was identified as a vulnerability exploitable for spyware distribution. Adam Boynton, senior enterprise strategy manager at Jamf, highlighted its potential for device infiltration. Similar flaws have been used in the past to target high-profile executives with spyware. ## Past similar attacks In recent years, zero-click spyware attacks triggered by malicious files delivered via messaging services have become prevalent. Examples include Operation Triangulation, attributed by Russia's FSB to the NSA, and FORCEDENTRY, used to distribute NSO Group's Pegasus spyware. ## Other vulnerabilities in WebKit Most of the other vulnerabilities in the iOS 26.6.1 update are in WebKit, Apple's most frequently targeted framework. CVE-2026-65329, a flaw in the Telephony component of iPhone 11 and later models, stands out. This vulnerability could allow attackers to intercept network traffic. ## Risk for IPSec connections The CVE-2026-65329 flaw poses a more serious threat to organizations relying on IPSec-based connections. Apple addressed the issue by improving state management. Attackers would need a privileged network position to exploit this vulnerability. ## Updates for older devices Apple also released iOS 18.7.10 and iPadOS 18.7.10 for older devices unable to run iOS 26, including the iPhone XS, XS Max, and XR. Additionally, visionOS 26.6.1 was updated, though details remain pending. ## Why is this update important? Apple's update significantly enhances device security, particularly against spyware threats. Closing critical vulnerabilities like CVE-2026-65346 protects users' personal and corporate data. Experts emphasize the importance of timely installation of such updates. ## Sources covering this story - https://www.theregister.com/security/2026/08/18/apple-plugs-image-processing-hole-ripe-for-spyware-abuse/5289031 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._