> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # July Apple updates are especially important if you receive images - URL: https://f4n6.co.uk/security-feed/july-apple-updates-are-especially-important-if-you-receive-images/ - Published: 2026-07-28T13:24:20.000Z - Updated: 2026-07-28T13:24:20.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-43818, CVE-2026-43776, CVE-2026-64763, CVE-2026-64764, CVE-2026-64765 ## 1\. Executive summary Apple shipped a July 2026 security patch round covering iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6\. The most notable fixes address file-parsing vulnerabilities in ImageIO (CVE-2026-43818), AppleDouble (CVE-2026-43776, CVSS 7.8 HIGH, CWE-120 Classic Buffer Overflow), and SceneKit (CVE-2026-64763 through CVE-2026-64766) that could allow arbitrary code execution from processing a maliciously crafted file. None of the six tracked CVEs are listed in CISA KEV. For EMEA financial services, the risk is a compromised executive or trader device via a weaponised image or 3D asset delivered through Messages, Mail, or Safari — patching endpoints and MDM-controlled fleets is the priority. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 24: digital operational resilience testing — general requirements | Apple's July patch set remediates native file-parser memory-corruption flaws (ImageIO, AppleDouble, SceneKit) across the full device fleet. | Clients must verify that Apple device fleets (including BYOD under MDM) are enrolled in a resilience testing programme that confirms patch compliance for this specific cycle. | | DORA Art. 17: ICT-related incident management process | The patched vulnerabilities enable arbitrary code execution via files received through standard communication channels (Messages, Mail, Safari). | If a device is compromised via one of these parsers before patching, the incident response process must account for native macOS/iOS parser exploitation as a valid initial-access vector. | ## 3\. Technical analysis & attack chain This is a patch-roundup advisory covering six tracked CVEs across three Apple frameworks. None are in CISA KEV; none are reported as exploited in the wild. ### Prioritised triage table | CVE | Component | CVSS | KEV/EPSS | Why it matters | | -------------- | ----------- | -------- | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-43776 | AppleDouble | 7.8 HIGH | Not in KEV / EPSS unknown | Buffer overflow (CWE-120) in metadata parser triggered by files on network drives or shared with non-Apple systems; enterprise file-sharing context. | | CVE-2026-43818 | ImageIO | Unknown | Not in KEV / EPSS unknown | Malicious image (JPEG, PNG, TIFF, RAW, GIF) processed by Photos, Safari, Messages, Mail, or Preview can achieve arbitrary code execution. | | CVE-2026-64763 | SceneKit | Unknown | Not in KEV / EPSS unknown | Malicious 3D asset / scene description file can achieve arbitrary code execution during rendering. | | CVE-2026-64764 | SceneKit | Unknown | Not in KEV / EPSS unknown | Same impact and vector as CVE-2026-64763. | | CVE-2026-64765 | SceneKit | Unknown | Not in KEV / EPSS unknown | Same impact and vector as CVE-2026-64763. | | CVE-2026-64766 | SceneKit | Unknown | Not in KEV / EPSS unknown | Same impact and vector as CVE-2026-64763. | ### Attack chain — ImageIO (CVE-2026-43818) and AppleDouble (CVE-2026-43776) 1. **Delivery:** Attacker sends a maliciously crafted image file (JPEG, PNG, TIFF, RAW, GIF or other format supported by ImageIO) to the target via Messages, Mail, or a web page loaded in Safari. Alternatively, for AppleDouble, a file with crafted hidden metadata is placed on a network drive or shared volume accessible to the target. 2. **Parsing:** The target's device automatically processes the file through ImageIO (for images) or the AppleDouble metadata reader (for files on network shares). ImageIO is invoked system-wide by Photos, Safari, Messages, Mail, and Preview — no user action beyond receiving or opening the message/page is required for image parsing. AppleDouble parsing occurs transparently when macOS reads Finder metadata from the network store. 3. **Memory corruption:** The crafted file triggers a memory-corruption condition in the parser. For CVE-2026-43776, this is a classic buffer overflow (CWE-120). The specific mechanism for CVE-2026-43818 is not detailed in the source beyond the standard Apple boilerplate. 4. **Code execution:** The memory corruption may be leveraged for arbitrary code execution within the context of the parsing process. The impact description for all six CVEs is identical: "Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution." ### Attack chain — SceneKit (CVE-2026-64763 through CVE-2026-64766) 1. **Delivery:** Attacker delivers a maliciously crafted 3D scene description file or 3D asset to the target. 2. **Parsing:** SceneKit parses the scene description file and converts it into renderable content. The framework is used in apps and games on Apple platforms. 3. **Memory corruption / code execution:** Same boilerplate impact — unexpected app termination or arbitrary code execution. ### Framework context - **ImageIO** reads and displays image formats (JPEG, PNG, TIFF, RAW, GIF, others) and is used system-wide by Photos, Safari, Messages, Mail, and Preview on both iOS and macOS. - **AppleDouble** stores macOS file metadata (icons, Finder details) when files reside on certain disk types or network drives, or are shared with non-Apple systems. The vulnerability is in the code that reads and writes this hidden metadata. - **SceneKit** is a 3D graphics / scene graph framework that parses scene description files and 3D assets for rendering models, animations, and complex 3D scenes. **Confidence caveat:** All technical detail is single-sourced (Malwarebytes, citing Apple advisories). CVSS scores are unavailable for five of the six CVEs in the verified reference data. No exploit code, proof-of-concept, or in-the-wild exploitation has been reported for any of these vulnerabilities. The June 2026 Apple update cycle (corpus-1, corpus-2) similarly reported no exploited vulnerabilities. ## 4\. Mitigation & containment ### P1 — within 24 hours - Patch all Apple endpoints to the latest available version: iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6\. Safari 26.6 is included in macOS updates; on Sonoma and Sequoia, verify Safari is offered independently via Software Update if macOS is not upgraded. - Via MDM, force-deploy the update to all enrolled iOS/iPadOS devices (iPhone 11+, iPad Pro 12.9" 3rd gen+, iPad Pro 11" 1st gen+, iPad Air 3rd gen+, iPad 8th gen+, iPad mini 5th gen+) and macOS fleets. - Advise staff not to open unsolicited images or 3D attachments in Messages, Mail, or Safari until devices are patched. ### P2 — within 72 hours - Identify and patch any Apple devices running older unsupported versions that cannot receive 26.6; these have no remediation path for these CVEs and should be isolated or retired. - For AppleDouble (CVE-2026-43776 specifically): review network share configurations and restrict automatic metadata parsing on macOS clients connecting to non-Apple SMB/NFS servers where feasible. - Enable Automatic Updates on all iOS/iPadOS devices via MDM policy (Settings > General > Software Update > Automatic Updates). ### P3 — within 7 days - Verify patch compliance across the full fleet via MDM reporting; chase non-compliant devices. - Update EDR / mobile threat defence policies to flag unexpected process crashes in ImageIO-related processes (Photos, Safari, Messages, Mail, Preview) and SceneKit rendering processes as potential exploitation attempts. - Incorporate this patch cycle into DORA Art. 24 resilience testing documentation. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ## 6\. Detection Insufficient indicators to author detection rules. The sources describe vulnerability classes and framework names but do not provide distinctive strings, file names, command-line artefacts, mutex names, or behavioural patterns specific to exploitation of these CVEs. ## CVE assessment 6 referenced CVEs | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-43776](https://nvd.nist.gov/vuln/detail/CVE-2026-43776?ref=f4n6.co.uk) | 7.8 High | — | — | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 1… | | [CVE-2026-43818](https://nvd.nist.gov/vuln/detail/CVE-2026-43818?ref=f4n6.co.uk) | — | — | — | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoi… | | [CVE-2026-64763](https://nvd.nist.gov/vuln/detail/CVE-2026-64763?ref=f4n6.co.uk) | — | — | — | An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.6 and iPadOS 26.6, ma… | | [CVE-2026-64764](https://nvd.nist.gov/vuln/detail/CVE-2026-64764?ref=f4n6.co.uk) | — | — | — | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macO… | | [CVE-2026-64765](https://nvd.nist.gov/vuln/detail/CVE-2026-64765?ref=f4n6.co.uk) | — | — | — | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoi… | | [CVE-2026-64766](https://nvd.nist.gov/vuln/detail/CVE-2026-64766?ref=f4n6.co.uk) | — | — | — | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoi… | ## 7\. Sources - Malwarebytes, "July Apple updates are especially important if you receive images," https://www.malwarebytes.com/blog/news/2026/07/july-apple-updates-are-especially-important-if-you-receive-images, 2026-07-28 - SANS Internet Storm Center, "June 2026 Apple Updates," https://isc.sans.edu/diary/rss/33114, 2026-06-30 - Malwarebytes Labs, "Update time: Apple releases security patches for iOS, MacOS Tahoe, Safari," https://www.malwarebytes.com/blog/news/2026/06/update-time-apple-releases-security-patches-for-ios-macos-tahoe-safari, 2026-06 ## 8\. Adverse Trace position This is a standard Apple patch cycle with no confirmed in-the-wild exploitation. The severity is elevated by the attack surface: ImageIO processes images system-wide across Messages, Mail, Safari, Photos, and Preview, meaning a weaponised image requires minimal user interaction. CVE-2026-43776 (AppleDouble, CVSS 7.8 HIGH) is the only tracked CVE with a confirmed score and is relevant to enterprise environments using network shares. The four SceneKit CVEs and CVE-2026-43818 lack CVSS scores in NVD, preventing independent severity re-assessment. We assess the risk to EMEA financial services as moderate but actionable: a compromised executive device via a crafted image is a viable initial-access vector for follow-on credential theft or session hijacking. Clients should enforce patching via MDM within 72 hours and restrict handling of unsolicited image attachments on unpatched devices. We will monitor for proof-of-concept code or KEV additions and re-issue if exploitation is confirmed. --- [Read the original source →](https://www.malwarebytes.com/blog/news/2026/07/july-apple-updates-are-especially-important-if-you-receive-images?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*