CVE-2026-65346: Integer Overflow

Q: Which systems should be prioritized for remediation?

Devices running iOS earlier than 26.6.1, iPadOS earlier than 26.6.1, or macOS Tahoe earlier than 26.6.2 are affected according to the available fix information. The data does not identify any affected configurations beyond those software versions.

Q: What must occur for exploitation to be possible?

Exploitation requires processing an image, which may lead to arbitrary code execution. The available information does not specify a delivery method, user interaction requirements, or whether the image must be maliciously crafted.

Q: What is the available remediation?

Update iOS and iPadOS to 26.6.1 or later, and update macOS Tahoe to 26.6.2 or later. The provided information does not describe a workaround or mitigation for systems that cannot yet be updated.

Published Aug 17, 2026

Updated

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to arbitrary code execution.

Other sources

Audio. A logic issue was addressed with improved checks.

— Apple

ImageIO. An integer overflow was addressed with improved input validation.

— Apple

ImageIO. The issue was addressed with improved checks.

— Apple

Credit

Meta Red Team X - Nik Tsytsarkin, Geonha Lee@@leegn4a, f00l@@PPPF00L, 3ndy1@@_3ndy1, Minghao Lin@@Y1nkoc, 云散花折, Arjanit Isufi, Drinor Selmanaj (Sentry), Surya Narayan Kushwaha, an anonymous researcher, Bhaswanth Chigurupati(STAR Labs SG Pte), Billy Jheng Bing Jhong(STAR Labs SG Pte), Pan Zhenpeng@@Peterpan0927(STAR Labs SG Pte), Bedran Karakoc(Ruhr University Bochum), Tobias Funke(Ruhr University Bochum), Jacopo Clark(Ruhr University Bochum), Katharina Kohls(Ruhr University Bochum), Janggoon Lee(Out of Bounds), OpenAI Codex Security - Amy Burnett, wwwlk, Henock Habte, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel, Thomas Guillem, Niels Hofmans, Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Josef Korbel (Citadelo), Hossein Lotfi@@hosselot(TrendAI Zero Day Initiative), Dung Do@@_piers2(Calif), 杉山壮太, Mohit Negi, Shubham Chaskar(Braze Security Team), Tommy DeVoss@@thedawgyg(Braze Security Team)

Affected Software

6 affected componentsFixes available

Apple iOS<26.6.1

26.6.1

Apple iPadOS<26.6.1

26.6.1

Apple macOS Tahoe<26.6.2

26.6.2

Apple iPadOS<26.6.1

Apple iPhone OS<26.6.1

Apple macOS>=26.0<26.6.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.6.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.6.2
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 26.6.1
Upgrade
Upgrade iPadOS to a version that resolves this vulnerability.
Fixed in 26.6.1
Upgrade
Upgrade macOS Tahoe to a version that resolves this vulnerability.
Fixed in 26.6.2

Event History

Aug 17, 2026

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

Affected Software

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

DescriptionWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeaknessAffected Software

Aug 18, 2026

News Published

via ZDNet·02:12 PM

Aug 19, 2026

News Published

via ZDNet·02:18 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

Which systems should be prioritized for remediation?

Devices running iOS earlier than 26.6.1, iPadOS earlier than 26.6.1, or macOS Tahoe earlier than 26.6.2 are affected according to the available fix information. The data does not identify any affected configurations beyond those software versions.

What must occur for exploitation to be possible?

Exploitation requires processing an image, which may lead to arbitrary code execution. The available information does not specify a delivery method, user interaction requirements, or whether the image must be maliciously crafted.

What is the available remediation?

Update iOS and iPadOS to 26.6.1 or later, and update macOS Tahoe to 26.6.2 or later. The provided information does not describe a workaround or mitigation for systems that cannot yet be updated.

CVE-2026-65346: Integer Overflow

Other sources

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Which systems should be prioritized for remediation?

What must occur for exploitation to be possible?

What is the available remediation?

Company

Resources

Contact