Apple Patches ImageIO RCE: Numeric Truncation Fixed in macOS…

CVE-2026-43780 in Apple's ImageIO framework allowed remote code execution via malicious textures. The fix is available today across eight OS versions.

Editor's note: This article is based on ZDI advisory ZDI-26-492 with confirmations from the CVE record and Apple's advisory. Some impact details remain officially unquantified.

Trend Micro's Zero Day Initiative published advisory ZDI-26-492 on July 29, 2026, documenting a vulnerability in Apple's ImageIO framework on macOS. The bug, tracked as CVE-2026-43780, stems from a numeric truncation error in the handling of malicious textures. Apple fixed the flaw with the release of macOS Tahoe 26.6 and other updated versions. The coordinated disclosure comes five months after researcher Michael DePlante's initial report on February 19, 2026.

Key Takeaways

CVE-2026-43780: vulnerability in Apple macOS ImageIO framework caused by numeric truncation on unvalidated user input
ZDI advisory describes potential remote code execution; CVE record reports "unexpected app termination"
Patch deployed across eight OS versions: macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6
CVSS score and vector not publicly released by ZDI advisory or CVE record
Researcher Michael DePlante of Trend Micro ZDI reported the bug to Apple on February 19, 2026; coordinated disclosure occurred July 29, 2026
No evidence of active in-the-wild exploitation nor details on the specific file format triggering the vulnerability appear in the dossier

The Mechanism: How an Integer Truncation Opens the Door to RCE

The ImageIO framework handles parsing and decoding of images and textures across the Apple ecosystem. According to advisory ZDI-26-492, the vulnerability lies in the lack of validation of user-supplied data before buffer allocation. This flaw produces an integer truncation: a numeric value derived from input is silently truncated, generating an incorrect allocation size.

The arithmetic error can pave the way for a controlled memory overwrite. An attacker supplying a specially crafted texture could exploit the vulnerability to execute code in the context of the current process.

"The issue results from the lack of proper validation of user-supplied data, which can result in an integer truncation before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process." — Trend Micro Zero Day Initiative, ZDI-26-492

The bug falls into a class of flaws that has plagued media format parsers for decades: processing logic assumes dimensions derived from headers or metadata remain within safe bounds, without adequately verifying arithmetic constraints. The result is a discrepancy between the actual value and the one used for memory calculation.

The ZDI advisory specifies that "interaction with the ImageIO library is required to exploit this vulnerability but attack vectors may vary depending on the implementation." This indication suggests the vulnerable parser can be reached through various application paths, not limited to a single app or format.

From CVE Record to Patch: The Versions That Fix the Bug

The official CVE-2026-43780 record, published by cve.org, describes the impact as "Processing a maliciously crafted texture may lead to unexpected app termination." This wording differs from the RCE severity stated in the ZDI advisory. The brief does not clarify whether this difference reflects a guaranteed minimal impact or a conservative assessment by the CVE program.

Apple fixed the vulnerability with "improved input validation," according to both the CVE record and the vendor advisory for macOS Tahoe 26.6. The eight patched versions cover Apple's entire ecosystem: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The list confirms the same ImageIO component is shared across all of the company's operating systems.

The inclusion of macOS Sonoma 14.8.8 indicates Apple extended the fix to prior desktop OS versions, not limiting it to the latest major release. This choice suggests a risk assessment sufficient to justify backporting the fix.

What to Do Now

Users and administrators of Apple systems must prioritize verifying installation of the security updates released July 29, 2026. Specific actions:

Update to macOS Tahoe 26.6, macOS Sequoia 15.7.8, or macOS Sonoma 14.8.8 depending on the base version in use
Apply iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 on managed mobile and wearable devices
Verify that third-party apps processing images or textures use the updated system libraries, since the ZDI advisory indicates attack vectors may vary by implementation

The dossier does not specify whether temporary workarounds exist nor whether Apple released out-of-band security updates for versions prior to those listed. No indications of active exploitation emerge.

FAQ: Questions and Clarifications

What is the difference between "unexpected app termination" and RCE?

Advisory ZDI-26-492 describes the vulnerability as RCE, while the CVE record reports "unexpected app termination." The brief does not clarify which explanation is correct. This discrepancy between sources remains unresolved in the dossier.

Can I remain vulnerable if I don't use native Apple applications?

The brief indicates attack vectors may vary. It is not explicitly verified that any application calling ImageIO APIs can trigger the vulnerable parser.

Is a CVSS score known for this vulnerability?

No. CVSS score and vector have not been publicly released by the ZDI advisory or the CVE record. The brief explicitly notes these data are missing.

How much time passed between report and patch?

Five months: from February 19, 2026 (vendor report) to July 29, 2026 (coordinated disclosure). This timeline falls within the typical responsible disclosure cycle managed by ZDI.

Information verified against cited sources and current as of publication.

Sources

Sources and references