CVE-2026-43818 et al: Apple Image Processing — Remote Code Execution Risk (July 2026)

CVE-2026-43818 et al — Apple Image Processing Vulnerabilities

Multiple high-severity vulnerabilities (CVE-2026-43818, CVE-2026-43776, CVE-2026-64763, CVE-2026-64764, CVE-2026-64765, CVE-2026-64766) have been patched by Apple in July 2026. These flaws impact core frameworks including ImageIO, AppleDouble, and SceneKit, and can allow remote code execution or application crashes when processing maliciously crafted image files. No evidence of active exploitation has been reported, but the attack surface is broad and risk is elevated.

Attack Vector

Attackers can exploit these vulnerabilities by sending specially crafted image files to users via email, messaging apps, or web downloads. When a vulnerable Apple device processes one of these files—such as previewing an image in Mail or Safari—the underlying framework may trigger a memory corruption or logic flaw, leading to arbitrary code execution or forced application termination. No user interaction beyond opening or previewing the file is required. There are no published IOCs at this time, but any unexpected app crashes following image file handling should be investigated.

Who Is at Risk

All organizations and users operating unpatched versions of iOS, iPadOS, macOS, and Safari are at risk. The vulnerabilities affect a wide range of Apple devices, including iPhones, iPads, and Macs. Enterprises with BYOD policies or those that routinely exchange files with external parties are especially exposed. Apple is the only confirmed affected vendor.

Patch & Mitigate

• Patch: Deploy the July 2026 Apple security updates for iOS, iPadOS, macOS, and Safari immediately. Reference Apple’s official security update documentation for exact version numbers.
• Workaround: No viable workarounds are available. Restrict opening image files from untrusted sources until patched.
• Detect: Monitor logs for unexpected application terminations related to ImageIO, AppleDouble, or SceneKit. Investigate crash reports or abnormal process behavior following image file handling.

MITRE ATT&CK

• TA0005 — Defense Evasion: Attackers use crafted files to bypass standard file validation and execute code.
• T1204 — User Execution: Exploitation occurs when a user opens or previews a malicious image file.

Source: https://www.malwarebytes.com/blog/news/2026/07/july-apple-updates-are-especially-important-if-you-receive-images