{"id":404534,"date":"2026-08-22T02:49:54","date_gmt":"2026-08-22T02:49:54","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=404534"},"modified":"2026-08-22T02:49:54","modified_gmt":"2026-08-22T02:49:54","slug":"iphone-ios-26-6-1","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/iphone-ios-26-6-1\/","title":{"rendered":"An image can run code on your iPhone. Install 26.6.1"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The iPhone turns files into pictures all day. A preview in Messages. A photo in Mail. A page in Safari. Monday&#8217;s iOS 26.6.1 closes an ImageIO bug where processing an image can run code on the device. Apple has not said anyone is using it. The installer is already in Settings.<\/p><div id=\"mwtad968291965\" class=\"gas_fallback-ad_309684--placement_400588\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3957935887\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-iphone-overview.png\" alt=\"iPhone showing iOS 26.6.1 Software Update\" class=\"wp-image-404602\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-iphone-overview.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-iphone-overview-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-iphone-overview-1024x683.png 1024w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><figcaption class=\"wp-element-caption\">The fix is in Settings.<\/figcaption><\/figure>\n\n\n\n<div id=\"mwtad672601507\" class=\"gas_fallback-ad_309747-ad_309691-placement_400589\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9589536513\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What broke<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On 17 August 2026 Apple released iOS 26.6.1 and iPadOS 26.6.1. The row that matters on a home phone is ImageIO, the decoder that turns a file into pixels. Apple&#8217;s wording for <a href=\"https:\/\/support.apple.com\/en-us\/148282\" target=\"_blank\" rel=\"noopener\">CVE-2026-65346<\/a> is plain: an integer overflow was addressed with improved input validation, and processing an image may lead to arbitrary code execution.<\/p>\n\n\n\n<div id=\"mwtad525066467\" class=\"mwtadp1 mwtadentity-placement\" style=\"margin-top: 50px;margin-bottom: 50px;\"> \r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-7750719144850257\"\r\n     data-ad-slot=\"7312657698\"><\/ins>\r\n <\/div><p class=\"wp-block-paragraph\">Integer overflow is a size lie. The decoder reads a number that is supposed to be how much memory to allocate. The number wraps. The buffer is too small. The extra bytes land next door and can become instructions. The file still looks like a picture. That is why a decoder bug is never &#8220;just a photo.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is not a Safari-only hole. Safari uses ImageIO. So do Messages previews, Mail attachments, Photos, and in-app browsers. You do not install a picture attack. You open it, or the phone previews it for you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same <a href=\"https:\/\/support.apple.com\/en-us\/148282\" target=\"_blank\" rel=\"noopener\">iOS 26.6.1 security content<\/a> has a long WebKit list. Those rows talk about crafted pages that can crash Safari or corrupt memory. Take the update for those too. They are not the decoder RCE. Do not merge them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A separate, lesser item lives under Telephony: <a href=\"https:\/\/support.apple.com\/en-us\/148282\" target=\"_blank\" rel=\"noopener\">CVE-2026-65329<\/a>. Apple says an attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic. That is hostile Wi-Fi or a LAN foothold, not a stranger with a JPEG. It is not the ImageIO bug. It is not a Safari RCE. Apple lists it for iPhone 11 and later only. The iPad list does not get that row.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Apple has not said any of these are being used in the wild. The writeups are public. The build is in Settings. That is the window.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who is in range<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Anyone still below 26.6.1 on an iPhone 11 or later, or on an iPad Apple lists for this build: iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later. The kitchen iPad counts. The shop loaner counts. The phone you &#8220;do not browse on&#8221; still decodes images in Messages and Mail.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">iPhone XS, iPhone XS Max, iPhone XR, and iPad 7th generation are on the older train. They take <a href=\"https:\/\/support.apple.com\/en-us\/148287\" target=\"_blank\" rel=\"noopener\">iOS 18.7.10 or iPadOS 18.7.10<\/a>, not 26.6.1. A device that cannot install either build is out of Apple&#8217;s security line. That is a replacement, not a missing toggle. Cafe Wi-Fi makes the telephony IPSec item extra relevant on an iPhone. It does not change the click.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What the vendor shipped<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>iOS 26.6.1 and iPadOS 26.6.1, released 17 August 2026, for iPhone 11 and later and the listed iPads<\/li>\n<li>iOS 18.7.10 and iPadOS 18.7.10, released 17 August 2026, for iPhone XS, XS Max, XR, and iPad 7th generation<\/li>\n<li>Settings, General, Software Update. Keep the device on power and Wi-Fi. The phone restarts itself after the install.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">One Settings screen. Two version numbers, depending on the hardware. There is no separate Safari update on the phone. The system build is the browser build.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What this is not<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not CVE-2026-65329 as the decoder. That CVE is Telephony and IPSec. The decoder RCE is CVE-2026-65346.<\/li>\n<li>Not a Safari-only RCE. WebKit on this note is mostly crash and memory-corruption rows. The code-exec picture bug is ImageIO.<\/li>\n<li>Not claimed in the wild. Apple&#8217;s pages do not say these are being used.<\/li>\n<li>Not finished if Settings still reads 26.6 or 26.6.0. The line you want is 26.6.1, or 18.7.10 on the older devices.<\/li>\n<li>Not patched by updating Safari on a Mac. <a href=\"https:\/\/support.apple.com\/en-us\/148286\" target=\"_blank\" rel=\"noopener\">Safari 26.6.1<\/a> on Sonoma and Sequoia is a WebKit package. It does not close ImageIO on the iPhone.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The patch is out. Software Update is already in Settings. That is the cheap window.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-iphone-hero.png\" alt=\"Do This Now card: Update the iPhone, in range You, urgency This week, then Software Update\" class=\"wp-image-404533\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-iphone-hero.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-iphone-hero-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-iphone-hero-1024x683.png 1024w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><figcaption class=\"wp-element-caption\">Install iOS 26.6.1.<\/figcaption><\/figure>\n\n\n\n<div id=\"mwtad2205234029\" class=\"gas_fallback-ad_309748-ad_309691-placement_400590\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3906789406\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Do This Now<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>In range:<\/strong> You. iPhone 11 and later, and the iPads Apple lists for iPadOS 26.6.1, still below 26.6.1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Urgency:<\/strong> This week. Apple has not said these are in the wild. The build is already in Settings.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Settings, General, Software Update. Install iOS 26.6.1 or iPadOS 26.6.1. Keep the device on power and Wi-Fi.<\/li>\n<li>Older iPhone XS, XS Max, XR, and 7th-gen iPad: take iOS 18.7.10 or iPadOS 18.7.10 instead.<\/li>\n<li>The other iPhone or iPad in the house: same path tonight. A Mac still on Sonoma or Sequoia can take Safari 26.6.1 from Software Update. That is WebKit, not the phone decoder.<\/li>\n<\/ol>\n\n\n\n<div id=\"mwtad2901013276\" class=\"gas_fallback-ad_309749-ad_309691-placement_400591\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5354318971\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Who can skip<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Settings already shows iOS 26.6.1, iPadOS 26.6.1, or iOS 18.7.10 \/ iPadOS 18.7.10. Read the number. Do not trust the banner alone if the version is still 26.6 or 26.6.0.<\/li>\n<li>No iPhone and no iPad in the house. This tab is not yours.<\/li>\n<li>A device too old for 26.6.1 and too old for 18.7.10. Apple is not shipping this fix there. That is a replacement, not a skip for a phone that can still move.<\/li>\n<li>A shop iPhone or iPad frozen by MDM will not self-update. That is an IT push of 26.6.1 or 18.7.10, not a skip for the fleet.<\/li>\n<\/ul>\n\n\n\n<div id=\"mwtad2929487122\" class=\"gas_fallback-ad_309750-ad_309691-placement_400592\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"4041237300\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Why it matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The phone holds the session you already logged into. Mail, the bank app, the authenticator, the photos. A decoder that can run code is how a file stops being a file and starts being the process. You do not need a second exploit story for that to be worth a charge-and-install.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">People skip Software Update because it asks for a restart. The preview in Messages does not ask. The Mail thumbnail does not ask. Apple described the bugs and shipped the build. That is the cheap window. There is no honest reason to sit on 26.6 while 26.6.1 is on the same screen.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-65329 is the lesser reason, not the lead. If you join a network you do not run, IPSec is the tunnel you thought you had. A privileged-network attacker who can bypass that authentication can intercept traffic. Cafe Wi-Fi, a hotel LAN, a shop guest network. Still not the decoder. Still not Safari. Still the same install.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A shop that leaves a loaner iPad on last month&#8217;s build is the other half of in range. The front-desk phone, the kitchen tablet, the child&#8217;s old XS that never moved to 18.7.10. This week is the click. The menu is already there.<\/p>\n\n\n\n<div id=\"mwtad3706098323\" class=\"gas_fallback-ad_309751-ad_309691-placement_400593\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3690286463\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">The bottom line<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">On the iPhone<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Plug the phone in. Stay on a Wi-Fi network you already trust. Cellular downloads stall, and a cafe portal will sit at 0%.<\/li>\n<li>Open Settings. Tap General. Tap Software Update. You do not need a Mac or iTunes.<\/li>\n<li>Wait for the screen to finish checking. You want a card that says iOS 26.6.1, or iPadOS 26.6.1 on an iPad. Tap Update Now or Install Now. A passcode prompt is expected.<\/li>\n<li>Leave the phone on the charger. The bar will sit, then the Apple logo will loop. That loop is the install. Do not force-restart it because it looks stuck for ten minutes.<\/li>\n<li>After the phone returns, unlock it. Open Settings, General, About. The Version line should read 26.6.1. Do not trust the splash. Trust About.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">If Software Update will not move<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If the page says Unable to Check for Update, leave Wi-Fi, wait ten seconds, rejoin, and open Software Update again. A download that dies at a few percent is often a full disk. Settings, General, iPhone Storage: free a couple of gigabytes, then retry. Do not download an &#8220;iOS 26.6.1 IPSW&#8221; from a random site. Apple&#8217;s own Software Update screen is the installer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the phone is supervised, or Settings shows an update paused by your organization, you cannot finish this from the Home Screen. Ask whoever owns the MDM profile to push 26.6.1. Same build. Different delivery. If Software Update says you are up to date and About still reads 26.6 or 26.6.0, you are not done. Stay on the page, pull down to refresh, and give it a minute on power. Reboot once and open the same path again if it still refuses 26.6.1.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The older iPhone, the iPad, and the Mac<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>iPhone XS, XS Max, or XR: Settings, General, Software Update. The card you want is iOS 18.7.10, not 26.6.1. Those models do not get the 26 train.<\/li>\n<li>iPad 7th generation: same path, iPadOS 18.7.10. Newer listed iPads want iPadOS 26.6.1.<\/li>\n<li>The second phone in the drawer, the kitchen iPad, the shop loaner: same three taps tonight. One stale device is enough.<\/li>\n<li>A Mac on Sonoma or Sequoia: System Settings, General, Software Update, and take Safari 26.6.1 if it is offered. That closes the WebKit rows on that Mac. It does not patch the iPhone.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">What you should see<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On Software Update, the heading is the product name and a three-part number. 26 is the major. 6 is the train. 1 is this security point. About, under Version, should match after the restart: 26.6.1. On the older devices the same screen reads 18.7.10. If you still see 26.6, 26.5, 18.7.9, or anything older, you are not on this patch. The progress bar is the download. The Apple logo is the close. After unlock, About is the proof.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When you are done<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">About reads 26.6.1 on every iPhone 11 or later in the house, and 18.7.10 on every XS, XS Max, XR, and 7th-gen iPad. Each device has restarted once. You do not need to sign out of iCloud or wipe the phone for this brief. You needed a new build. You have it. The decoder hole and the telephony IPSec item close on that same number.<\/p>\n\n<div id=\"mwtad328692374\" class=\"gas_fallback-ad_176819-ad_309691-placement_400595\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8386082122\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>The iPhone turns files into pictures all day. A preview in Messages. A photo in Mail. A page in Safari. Monday&#8217;s iOS 26.6.1 closes an ImageIO bug where processing an image can run code on &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"An image can run code on your iPhone. Install 26.6.1\" class=\"read-more button\" href=\"https:\/\/malwaretips.com\/blogs\/iphone-ios-26-6-1\/#more-404534\" aria-label=\"Read more about An image can run code on your iPhone. Install 26.6.1\">Read more<\/a><\/p>\n","protected":false},"author":51,"featured_media":404602,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3605],"tags":[],"class_list":["post-404534","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/404534","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=404534"}],"version-history":[{"count":2,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/404534\/revisions"}],"predecessor-version":[{"id":404626,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/404534\/revisions\/404626"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/404602"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=404534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=404534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=404534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}