CVE-2026-65346 Details
Description
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing an image may lead to arbitrary code execution.
A vulnerability in the ImageIO component of multiple Apple operating systems, including iOS, iPadOS, macOS Sequoia, tvOS, visionOS, and watchOS, allows for arbitrary code execution. This vulnerability arises from an integer overflow that was addressed with improved input validation. The issue is present in versions prior to the latest releases for each respective operating system.
Users can update to iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, tvOS 27, visionOS 27, or watchOS 27 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apple ipados | < 26.6.1 |
CPE
Remediation
| |
| apple iphone os | < 26.6.1 |
CPE
Remediation
| |
| apple macos | >= 26.0, < 26.6.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | [email protected] |
| Aug 19, 2026 | CVE Modified | CISA-ADP |
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Aug 18, 2026 | CVE Modified | CISA-ADP |
| Aug 17, 2026 | New CVE Received | [email protected] |