Apple plugs image-processing hole ripe for spyware abuse

Apple has released a batch of vulnerability fixes for iPhones, iPads, and Macs, including an image-processing flaw that experts say has the hallmarks of a spyware delivery vector. The most notable patch is for CVE-2026-65346, a defect in the ImageIO framework Apple uses to parse image files. Discovered and reported by Nik Tsytsarkin of Meta's Red Team X, CVE-2026-65346 is an integer-overflow bug that could allow arbitrary code execution when an affected device processes an image. The bug affects