Loading story…
Apple reportedly fixed CVE-2026-86869, dubbed EX-ARRR, a zero-click vulnerability in the libAppleEXR image decoder affecting iOS, iPadOS, and macOS 27. A crafted RGB OpenEXR (.exr) image can trigger a heap overflow when the decoder allocates 12 bytes per pixel but writes four-channel RGBA data at 16 bytes per pixel, creating a controlled linear overwrite.
An attacker could deliver the malicious EXR file through iMessage without requiring the recipient to open it: background photo-library indexing and thumbnail processing can decode the attachment after delivery. The reported processing path occurs in a separate daemon and may therefore fall outside BlastDoor’s protections. Researchers reported deterministic heap corruption, arbitrary-write capability, and program-counter control in a controlled harness, although Pointer Authentication and hardware memory tagging may complicate exploitation on newer Apple hardware. Organizations should prioritize the September 2026 Apple updates, as unpatched devices remain exposed.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Apple fixed CVE-2026-86869 across iOS, iPadOS, and macOS 27. The issue could allow a crafted EXR attachment to reach vulnerable ImageIO processing through background iMessage attachment indexing and thumbnail workflows without recipient interaction.
Apple received the vulnerability report, reproducer, crafted EXR files, and on-device crash artifacts. Apple Security reportedly classified it as 0-click code execution via an iMessage EXR image payload.
The researcher identified the libAppleEXR vulnerability through LLM-guided, disassembly-anchored fuzzing. The flaw is a controlled heap overflow caused by writing four RGBA channels into a buffer allocated for three RGB channels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates for **CVE-2026-86950**, an out-of-bounds write vulnerability in CoreGraphics that can enable arbitrary code execution when a victim processes a maliciously crafted file. Apple said it is aware of reports that the issue may have been used in an “extremely sophisticated” targeted attack against specific individuals running iOS versions before iOS 27; it did not disclose the attackers, victim count, compromise details, or timing. The company fixed the flaw with improved bounds checking in **iOS 26.7.1**, **iPadOS 26.7.1**, **macOS Tahoe 26.7.1**, and **macOS Sequoia 15.8.1**, and credited Meta Product Security with reporting it. Organizations should prioritize deployment across supported Apple endpoints, particularly devices remaining on pre-iOS 27 releases, because exploitation requires only user processing of a malicious file and could result in full confidentiality, integrity, and availability impact.
Sep 30, 2026
Apple released security updates to address an **actively exploited zero-day** tracked as **CVE-2026-20700**, warning it may have been used in an “extremely sophisticated” attack targeting specific individuals on versions of iOS prior to *iOS 26*. The flaw affects **`dyld` (Apple’s dynamic linker)** and can allow **arbitrary code execution** when an attacker already has **memory write** capability; reporting attributes discovery to **Google’s Threat Analysis Group** and notes it may have been used as part of an exploit chain. Apple shipped fixes across its ecosystem, including *iOS 26.3*, *iPadOS 26.3*, *macOS Tahoe 26.3*, *watchOS 26.3*, *tvOS 26.3*, and *visionOS 26.3*. The same reporting indicates Apple also issued patches tied to the broader report for **CVE-2025-14174** (an out-of-bounds memory access issue in Chrome’s **ANGLE** graphics component on Mac) and **CVE-2025-43529** (a **use-after-free** leading to code execution), and commentary from security practitioners emphasized that enterprise risk is driven by **patch deployment speed**—particularly where updates rely on end users rather than enforced device management.
Jun 29, 2026
Apple released security updates for **CVE-2026-20700**, a **zero-day** in `dyld` (the Dynamic Link Editor) that can enable **arbitrary code execution** when an attacker already has a memory-write capability. Apple said it is aware the issue “may have been exploited” in **extremely sophisticated, targeted attacks** against specific individuals, and credited **Google Threat Analysis Group (TAG)** with discovery. Apple also linked the same incident reporting to two earlier vulnerabilities (**CVE-2025-14174** and **CVE-2025-43529**) that were previously addressed. The fixes were shipped across Apple’s ecosystem, including **iOS/iPadOS**, **macOS** (including *macOS Tahoe*), **tvOS**, **watchOS**, and **visionOS**; impacted device families include iPhone 11 and later and multiple iPad generations, as well as Macs running *macOS Tahoe*. Canadian Centre for Cyber Security guidance echoed Apple’s warning of potential exploitation and urged rapid patching (e.g., **iOS/iPadOS 18.7.5** and **26.3** releases for newer OS lines). Other vendor advisories published in the same period (HPE, Chrome, Intel, Fortinet, Siemens, Dell, CISA ICS, IBM, Red Hat) are unrelated to the Apple zero-day and reflect routine multi-vendor patch activity rather than the specific exploitation event.
Jun 29, 2026