Apple Patches Critical ImageIO Integer‑Overflow (CVE‑2026‑65346) That Could Enable Arbitrary Code Execution
What Happened – Apple released security updates for 27 vulnerabilities across iPhone, iPad, macOS Tahoe and visionOS. The most serious is CVE‑2026‑65346, an integer‑overflow flaw in the ImageIO framework that can be triggered by a crafted image and lead to arbitrary code execution on the device.
Why It Matters for Compliance & Audit Readiness
- The flaw exemplifies a control gap in how image‑parsing libraries are validated and monitored – a scenario SOC 2 control CC6.1 (System Operations) is designed to detect and remediate.
- Continuous evidence of patch management and configuration baselines is required to demonstrate due diligence during a SOC 2 audit.
- Verisq’s Control Mapping capability lets you map this vulnerability to the relevant SOC 2 controls, collect automated proof of patch deployment, and keep a defensible audit trail.
Who Is Affected – Consumer‑device manufacturers, enterprise‑mobile‑management (EMM) providers, SaaS platforms that embed Apple‑based clients, and any organization that permits image uploads from Apple devices.
Recommended Actions
- Verify that all Apple endpoints (iOS, iPadOS, macOS, visionOS) are running the latest patches (iOS 26.6.1 / iPadOS 26.6.1, macOS Tahoe 26.6.2, etc.).
- Update your asset inventory and patch‑management logs to include CVE‑2026‑65346 as a control‑mapping item.
- Capture automated evidence of the update (e.g., MDM compliance reports) to satisfy SOC 2 CC6.1 and CC7.2 audit requirements.
Source: Malwarebytes Labs
Technical Notes – The vulnerability is an integer‑overflow in ImageIO’s image parsing routine. Processing a maliciously crafted image can cause memory corruption, enabling arbitrary code execution and potential privilege escalation. CVE‑2026‑65346 is rated CVSS 9.8 (High). No public exploits have been observed yet, but the attack surface includes any app that accepts untrusted images. Source: Apple Security Advisory