Skip to content
OriginalSign in

thezdi.comDustin Childs

Apple July 2026 Patch Fixes 210 Flaws Including ImageIO Bug

Part of the CVE-2026-43818 story · since 28 Jul

Quiet for 13 weekslast report 30 Jul2 articles2 outlets
28 Jul · Malwarebytes first14 Sep30 Sep16 OctNowThis article2nd of 2
  • Tue 28 Jul, 11:51 UTC. Malwarebytes, first report. Apple patches ImageIO flaw CVE-2026-43818 in July OS updates.
  • Thu 30 Jul, 15:50 UTC. thezdi.com, its first report on the story. Apple July 2026 Patch Fixes 210 Flaws Including ImageIO Bug. This article, 2nd of 2.

The July 2026 Apple Security Update Review presents a significant increase in vulnerabilities, with Apple releasing 210 unique CVEs compared to 37 in the previous month. Major components affected include iOS/iPadOS 26.6, various macOS versions, tvOS, watchOS, visionOS, and Safari. Key vulnerabilities highlighted include:

1. **CVE-2026-43818 (ImageIO)**: Allows arbitrary code execution via maliciously crafted images, posing the highest remote-exploitation risk.

2. **CVE-2026-64747 (AVEVideoEncoder)**: Enables arbitrary code execution with kernel privileges, leading to full device compromise.

3. **CVE-2026-64767 (afpfs)**: Permits remote attackers to corrupt kernel memory, posing a serious threat.

Other significant vulnerabilities include those related to Wi-Fi and various file-parsing operations. The summary emphasizes the critical nature of these updates and encourages users to stay informed on security patches from Apple and other vendors.

How the story developed

All 2 articles
Quiet for 13 weekslast report 30 Jul2 articles2 outlets

2 articles from 2 outlets since 28 Jul. Quiet since 30 Jul. This was the 2nd report, 2 days after the first.

Now28 Jul293031First reportMalwarebytes · 28 Jul, 11:51This article2nd of 2 · day 2
  • Tue 28 Jul, 11:51 UTC. Malwarebytes, first report. Apple patches ImageIO flaw CVE-2026-43818 in July OS updates.
  • Thu 30 Jul, 15:50 UTC. thezdi.com, its first report on the story. Apple July 2026 Patch Fixes 210 Flaws Including ImageIO Bug. This article, 2nd of 2.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 2 articles as a list
  1. Tue 28 JulDay 01
    1. Apple patches ImageIO flaw CVE-2026-43818 in July OS updates11:51 · Malwarebytes · First report

  2. Quiet for 2 days

    Thu 30 JulDay 21
    1. Apple July 2026 Patch Fixes 210 Flaws Including ImageIO Bug15:50 · thezdi.com · Picked up again · This article, 2nd of 2

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in