Apple Patches ImageIO: Parsing Bug Opens Door to RCE Across Eight Operating Systems

On July 29, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-492, documenting a vulnerability in Apple's ImageIO framework that allows remote arbitrary code execution. The bug, identified as CVE-2026-43780, was discovered by Michael DePlante (@izobashi) of the ZDI team and reported to Apple on February 19, 2026: a coordinated disclosure window of roughly five months that reflects the complexity of the multi-platform fix released by Cupertino.

The Mechanism: When Truncation Becomes Code Execution

The ImageIO framework is the system component Apple exposes for parsing and rendering graphic formats across all its platforms. System applications, browsers, mail clients, and third-party apps rely on this library to decode images without implementing their own parsers.

According to the ZDI advisory, the specific flaw consists of a lack of validation of user-supplied data in a texture, which causes an integer truncation before a buffer is allocated. The resulting buffer is smaller than the data copied into it, generating an overflow that overwrites adjacent memory areas. This opens the door to diverting execution flow toward attacker-controlled payloads.

The official CVE record describes the same bug as an "integer overflow" resolved with "improved input validation". The terminological difference — numeric truncation for ZDI, integer overflow for CVE — does not indicate two distinct vulnerabilities, but two ways of describing the same class of arithmetic error in the allocation size calculation.

"The specific flaw exists within the ImageIO framework. The issue results from the lack of proper validation of user-supplied data, which can result in an integer truncation before allocating a buffer." — ZDI Advisory ZDI-26-492

RCE vs "Unexpected App Termination": The Gap Between Commercial Disclosure and CVE Classification

One element that distinguishes this case is the divergence between the advisory's language and that of the official CVE record. ZDI explicitly states that the vulnerability "allows remote attackers to execute arbitrary code" and that it requires "interaction with the ImageIO library", adding that "attack vectors may vary depending on the implementation".

The CVE record, by contrast, concludes with a muted impact: "Processing a maliciously crafted texture may lead to unexpected app termination". This discrepancy is not rare in memory corruption bugs. CVE classification tends to describe the most immediately observable outcome — the crash — while the researcher or bounty program assesses the vulnerability's full potential, including elevation to RCE through developed exploit techniques.

The source does not provide a CVSS score or scoring vector: these data are not reported in either the ZDI advisory or the CVE record at the time of consultation.

The Attack Surface: Why ImageIO Is a Sensitive Target

ImageIO is not a marginal component. It is the standard gateway for every image traversing an Apple device: Finder previews, Mail attachments, Safari content, Messages images, textures in games and AR apps. The library is also exposed to third-party apps via public APIs, expanding the perimeter well beyond Apple software.

ZDI specifies that the attacker achieves execution "in the context of the current process". This means effective privileges depend on the application processing the image. A sandboxed browser limits impact; an app with extended privileges, or a system process, amplifies consequences. The source does not list which specific implementations are vulnerable, but the phrasing "attack vectors may vary depending on the implementation" implies that any app invoking ImageIO on untrusted input is potentially exposed.

The patches cover eight operating systems, confirming the bug is not confined to macOS but affects shared code across the entire Apple ecosystem. The fixed versions, per the CVE record, are: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

What to Do Now

• Verify the installed version on every corporate and personal Apple device: iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8 or Tahoe 26.6, and the corresponding updates for tvOS, visionOS, and watchOS
• Prioritize endpoints exposed to external content: workstations processing attachments, file previews, web content, or image streams from untrusted sources
• Check for third-party apps that use ImageIO for batch rendering or server-side graphic asset processing, where the vector might not require human interaction
• Monitor future Apple release notes for any expansion of the patch perimeter, given the CVE record lists fixed versions but does not specify which prior versions were vulnerable

The Coordinated Disclosure Window as a Complexity Indicator

The roughly 161 days between the February 19 report and the July 29 coordinated disclosure are above average for parsing vulnerabilities in core frameworks. This interval suggests two dynamics: the need to modify shared code across eight operating systems with different release cycles, and Apple's caution in validating that the fix introduced no regressions in rendering complex graphic formats.

Trend Micro's choice to keep the advisory under embargo for over five months — without publishing partial details in the meantime — also indicates a controlled risk assessment, likely based on the belief that the vulnerability was not being actively exploited in a way that would make the embargo unsustainable. Sources neither explicitly confirm nor deny the presence of in-the-wild exploits.

The vulnerability represents a significant case study for research on image parser security: seemingly passive components that sit on a critical security boundary between untrusted data and executed code.

FAQ

Why doesn't the CVE record mention RCE?

The CVE record describes the minimum guaranteed outcome — the app crash — while the ZDI advisory, written by the researcher who developed the proof-of-concept, documents the full potential. This discrepancy is frequent in memory corruption bugs, where actual impact depends on the attacker's ability to establish reliable exploit primitives.

Are all Apple devices vulnerable if not updated?

Sources list eight operating systems with specific patches. The bug resides in shared code, so every device running versions prior to those indicated is potentially exposed. The source does not specify whether older macOS versions (pre-Sonoma) or other unlisted OSes are affected.

What makes ImageIO an attractive target?

It is a universal parser exposed to untrusted input with a high probability of automatic interaction: a mail attachment, a browser preview, an image in a messaging app. The attacker does not need to induce the user to perform complex actions, only to view or download a graphic file.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-492/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-43780
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/

Information verified against cited sources and current as of publication.

Sources