A malicious image could have been enough to compromise an iPhone without the owner clicking a link, opening an attachment, or approving a permission request. While Apple has now patched the vulnerability, the person who found it is what makes the incident particularly interesting. It was Nik Tsytsarkin, a researcher with Meta’s Red Team X.
Apple disclosed the flaw, tracked as CVE-2026-65346, in its security update for iOS 26.6.1 and iPadOS 26.6.1 released on August 17. The vulnerability sits in ImageIO, Apple’s image-processing framework, and could allow arbitrary code execution when a maliciously crafted image was processed. Apple, however, fixed the problem by improving input validation.
The Vulnerability Was Hidden in Image Processing
ImageIO handles the processing of image files across Apple’s operating systems, making a flaw in the framework particularly significant.
Apple describes CVE-2026-65346 as an integer overflow. In simple terms, a calculation inside the image-processing code could produce a value outside the range the software expected. Apple said the issue could allow arbitrary code execution when an affected device processed an image.
The vulnerability affects iPhone 11 and later, as well as several recent iPad models. Apple also fixed the same vulnerability in macOS Tahoe 26.6.2.
This processing step is important because a zero-click attack does not depend on the victim actively interacting with the malicious content. Security researchers have highlighted image-processing vulnerabilities as a useful route for sophisticated attacks because devices can process images automatically as part of normal system and app functions.
However, it is important to note that Apple has not publicly said that CVE-2026-65346 was being exploited in the wild. The vulnerability had the characteristics that can make zero-click attacks dangerous, but there is no public confirmation that attackers used this particular flaw against real iPhone users.
Meta Was Looking at Apple’s Security From the Other Side
The vulnerability was discovered and reported by Tsytsarkin of Meta’s Red Team X, an internal security research team that looks for vulnerabilities and ways attackers could compromise software and devices.
This is not the first time Tsytsarkin’s work has focused on Apple’s image-processing technology. In 2023, he published research examining how Apple’s ImageIO framework processed images in the context of the BLASTPASS zero-click exploit, which had been used against Apple devices. Meta’s research also found that macOS had an undocumented option for moving ImageIO processing into a separate sandbox, although the same protection was not generally available on iOS at the time.
This background makes Meta’s discovery of another ImageIO vulnerability notable, as a security team inside one of the world’s largest technology companies was able to identify a flaw in a platform belonging to another major technology company before Apple’s own public disclosure.
Apple Has Now Closed the Hole
Apple released iOS 26.6.1 and iPadOS 26.6.1 to address the vulnerability, alongside fixes for other security issues. The company also patched CVE-2026-65346 in macOS Tahoe 26.6.2.
For iPhone users, the next step is to install the latest available security update rather than waiting for evidence that a particular vulnerability has already been exploited.
While Apple invests heavily in finding and fixing vulnerabilities in its platforms, some of these vulnerabilities are still being uncovered by security teams working outside Apple.
Meta finding this particular flaw does not mean Apple’s security model has failed. It only shows how much the security of widely used technology now depends on researchers across the industry testing each other’s systems, finding weaknesses, and reporting them before they become tools for attackers.
