Apple iOS/iPadOS/macOS: Arbitrary code execution via integer overflow in image processing
Summary
An integer overflow in Apple's image processing (ImageIO) allows arbitrary code execution when a maliciously crafted image is processed. According to the CVE record, the flaw affects iOS and iPadOS before 26.7.2 and before 27, and macOS before 15.8, before 26.7 and before 27. Exploitation requires that a user opens or processes the crafted image, for example via a message, mail, file share or web page.
Affected
- iOS and iPadOS before 26.7.2 and before 27 (per CVE record)
- macOS before 15.8, before 26.7 and before 27 (per CVE record)
- Exact build numbers per device model: Unknown.
Fixed in
- iOS 26.7.2 and iPadOS 26.7.2
- iOS 27 and iPadOS 27
- macOS Golden Gate 27
- macOS Sequoia 15.8
- macOS Tahoe 26.7
Workaround
Unknown. No workaround found in the sources; the fix is the vendor update.
Exploitation
- Not listed in CISA's Known Exploited Vulnerabilities catalog.
- CISA SSVC in the CVE record: exploitation none, not automatable, total technical impact.
- No exploitation evidence or public exploit code found as of 26 Oct 2026.
- Whether targeted exploitation has occurred: Unknown.
Our recommendation
- Update all iPhones, iPads and Macs to the fixed versions listed above, ideally via automatic updates.
- Verify the affected ranges and build numbers against Apple's security pages before rollout.
- Check that all Apple devices are inventoried and report their OS versions.
- Monitor for unpatched devices until the update is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple security content iOS 27 and iPadOS 27 support.apple.com
- Apple security content macOS Golden Gate 27 support.apple.com
- Apple security content iOS 26.7.2 and iPadOS 26.7.2 support.apple.com
- VulDB CVE-2026-64759 vuldb.com
- OpenCVE CVE-2026-64759 app.opencve.io
- CIS advisory multiple vulnerabilities in Apple products www.cisecurity.org
- OffSeq Radar CVE-2026-64759 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:24.
Original description (NVD)
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.