CVE-2026-65347: Apple iPadOS Image Processing DOS Vulnerability

CVE-2026-65347 Overview

CVE-2026-65347 is a denial-of-service vulnerability affecting Apple iOS, iPadOS, and macOS. The flaw resides in image processing logic and can be triggered when an affected system processes a maliciously crafted image. Apple addressed the issue with improved checks in iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. The weakness is classified under CWE-400 (Uncontrolled Resource Consumption). Exploitation requires user interaction, such as opening or previewing an attacker-supplied image, and does not require authentication. Successful exploitation impacts availability only; confidentiality and integrity remain unaffected.

Critical Impact
Processing a crafted image can cause an availability loss on affected iOS, iPadOS, and macOS devices, resulting in application or system-level denial-of-service.

Affected Products

Apple iOS (versions prior to 26.6.1)
Apple iPadOS (versions prior to 26.6.1)
Apple macOS Tahoe (versions prior to 26.6.2)

Discovery Timeline

2026-08-17 - CVE-2026-65347 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-65347

Vulnerability Analysis

CVE-2026-65347 is a denial-of-service condition in the image processing components shipped with iOS, iPadOS, and macOS. Apple's advisory states the issue was addressed with improved checks, indicating the pre-patch code path lacked adequate validation when parsing image data. An attacker who convinces a user to open or render a malicious image can force the target process into an unrecoverable state or excessive resource consumption. The associated weakness, [CWE-400], describes uncontrolled resource consumption where an application fails to properly restrict memory, CPU, or other resources during untrusted input handling.

Root Cause

The root cause is insufficient validation within an image decoding routine used by Apple operating systems. When the vulnerable parser encounters malformed structural fields inside an image, it fails to bound processing correctly. This triggers resource exhaustion or a fault that terminates the handling process. Apple did not publish granular technical details of the affected parser or image format. Refer to Apple Support Article #148281 and Apple Support Article #148282 for vendor guidance.

Attack Vector

An attacker delivers a crafted image over any network-accessible channel that leads to image rendering. Common delivery paths include messaging applications, email attachments, embedded web content, and shared documents. The victim must interact with the payload for the vulnerable code path to execute. No privileges are required on the target system. The result is a denial-of-service against the process handling the image, which may extend to the user session depending on the calling context.

No verified public exploit code is available for CVE-2026-65347. See the referenced Apple advisories for technical details.

Detection Methods for CVE-2026-65347

Indicators of Compromise

Repeated crashes or hangs in system image-handling processes such as ImageIO, Preview, Messages, or QuickLook on macOS.
Crash reports in ~/Library/Logs/DiagnosticReports/ referencing image decoder frames near the time an untrusted image was opened.
Elevated CPU or memory consumption tied to image rendering following receipt of unsolicited image attachments.

Detection Strategies

Monitor endpoint telemetry for abnormal termination of image-processing services and correlate with recently received attachments or downloaded files.
Inspect Mobile Device Management (MDM) compliance reports to identify iOS, iPadOS, and macOS devices running builds prior to 26.6.1 or 26.6.2.
Alert on inbound messages or emails carrying images with anomalous headers, structural inconsistencies, or unusually large chunk fields.

Monitoring Recommendations

Track Apple device OS version distribution across the fleet and prioritize outliers for patch enforcement.
Aggregate application crash logs from macOS endpoints into centralized logging for pattern analysis against known DoS behavior.
Baseline normal image-viewer resource utilization so spikes indicative of exploitation attempts can be surfaced quickly.

How to Mitigate CVE-2026-65347

Immediate Actions Required

Update iOS and iPadOS devices to version 26.6.1 or later through Settings > General > Software Update.
Upgrade macOS Tahoe systems to version 26.6.2 or later via System Settings > General > Software Update.
Enforce patch compliance through MDM policies and block non-compliant devices from accessing sensitive corporate resources.

Patch Information

Apple resolved CVE-2026-65347 in iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 by introducing improved checks in the affected image processing code paths. Deployment guidance is available in Apple Support Article #148281 and Apple Support Article #148282. Apply these updates on all affected devices as the primary remediation.

Workarounds

Instruct users to avoid opening image attachments from untrusted or unsolicited senders until patches are applied.
Disable automatic image previews in messaging and email clients where the feature is configurable.
Restrict inbound file types at email and web gateways to reduce delivery of crafted images to unpatched endpoints.

bash

# Verify macOS build version on an endpoint
sw_vers -productVersion

# Query iOS/iPadOS versions across managed fleet (example via MDM API)
# Replace with your MDM tenant endpoint and authentication
curl -H "Authorization: Bearer $MDM_TOKEN" \
  https://mdm.example.com/api/devices?os=iOS \
  | jq '.devices[] | select(.osVersion < "26.6.1") | .serialNumber'