CVE-2026-65347: 
macOS vulnerability analysis and mitigation

CVE-2026-65347 is a denial-of-service vulnerability in Apple's ImageIO framework affecting iOS, iPadOS, and macOS. Processing a specially crafted image can cause the affected application or system to become unresponsive or crash. The vulnerability was discovered by Geonha Lee (@leegn4a) and disclosed on August 17, 2026, alongside Apple's security updates. Affected versions include iOS and iPadOS prior to 26.6.1, and macOS Tahoe prior to 26.6.2. The CVSS base score is listed as 0.0 (unscored at time of publication), with Feedly estimating a Medium severity (Apple iOS Advisory, Apple macOS Advisory).

The vulnerability resides in Apple's ImageIO component, which handles image parsing and decoding across iOS, iPadOS, and macOS. The root cause is insufficient input validation during image processing — Apple's fix description states "the issue was addressed with improved checks," suggesting a missing or inadequate boundary or format check (no specific CWE has been assigned). An attacker can exploit this by supplying a maliciously crafted image file to any application or system function that invokes ImageIO for parsing, requiring no authentication or special privileges. No public proof-of-concept or detailed technical write-up has been published as of the disclosure date (Apple iOS Advisory, Apple macOS Advisory, GitHub Advisory).

Successful exploitation causes a denial-of-service condition, crashing or hanging the application or system that processes the malicious image. The impact is limited to availability — there is no reported confidentiality or integrity compromise associated with this specific CVE (a separate related CVE, CVE-2026-65346, addresses arbitrary code execution in ImageIO). The vulnerability affects a broad range of Apple devices running iOS 26, iPadOS 26, and macOS Tahoe, including iPhone 11 and later and multiple iPad generations (Apple iOS Advisory, Apple macOS Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the disclosure date. The EPSS score is reported as 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

Apple has released patches addressing this vulnerability: update to iOS 26.6.1, iPadOS 26.6.1, or macOS Tahoe 26.6.2 to remediate the issue. Users should apply these updates promptly via Settings > General > Software Update (iOS/iPadOS) or System Settings > General > Software Update (macOS). As a temporary workaround where immediate patching is not feasible, restricting the processing of untrusted or externally sourced image files may reduce exposure (Apple iOS Advisory, Apple macOS Advisory).

The vulnerability was noted by SANS Internet Storm Center shortly after disclosure, and aggregated by security tracking services including AusCERT (ESB-2026.9639) and Cyberkendra, which covered Apple's broader August 2026 patch release addressing 122 flaws. Community reaction has been routine given the medium severity and DoS-only impact, with no significant controversy or elevated concern reported (SANS ISC, AusCERT).