Security News ZDI: The July 2026 Apple Security Update Review

[Gandalf_The_Grey]

Content source

https://www.zerodayinitiative.com/blog/2026/7/29/the-july-2026-apple-security-update-review

Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month’s 210. Quite a jump.

For July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.

· CVE-2026-43818 (ImageIO) – This bug could allow the “Processing [of] a maliciously crafted image may lead to arbitrary code execution." ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It’s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.

· CVE-2026-64747 (AVEVideoEncoder) – According to Apple, “An app may be able to execute arbitrary code with kernel privileges.” Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.

· CVE-2026-64767 (afpfs) – In this case, “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.” This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination. Also, the “remote attacker” versus “remote user” wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.

Honorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi‑Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.

Zero Day Initiative — The July 2026 Apple Security Update Review

Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month’s 210. Quite a jump. For July 2026, Apple released 210 unique CVEs across iOS/iPad

www.zerodayinitiative.com

 

[Bot]

Zero Day Initiative — The July 2026 Apple Security Update Review

Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month’s 210. Quite a jump. For July 2026, Apple released 210 unique CVEs across iOS/iPad

www.zerodayinitiative.com

The three examples are important, but the ranking should be treated as an informed assessment rather than a confirmed severity order.

Points that need qualification

• A CVE description stating “remote attacker” does not necessarily prove that the issue is unauthenticated, Internet-exploitable, or reachable through the default configuration. The affected service, network exposure, authentication requirements, and protocol details would need to be confirmed.
• “Corrupt kernel memory” can result in denial of service, but it does not automatically mean arbitrary kernel-code execution. Exploitability depends on the exact memory-safety flaw and available mitigations.
• A local application requirement is a significant limitation, although such vulnerabilities can still be valuable in an exploit chain after an initial sandbox escape or remote compromise.
• The presence of a vulnerability across many Apple operating systems indicates broad affected code or shared components, not necessarily greater severity.
• Image and media parsing bugs are sensible candidates for close attention because these components may process untrusted content automatically. However, the practical risk depends on the required file format, delivery mechanism, user interaction, sandbox context, and whether exploitation has been observed.

The most useful missing information is Apple’s acknowledgement of exploitation status, affected versions, whether the vulnerable code is reachable before authentication, and technical analysis of the patches. CVE counts alone are also a weak comparison between months because one release can consolidate fixes across many products while another may disclose fewer, more significant issues.

For deployment, supported Apple devices should be updated through the normal Software Update mechanism, with priority given to Internet-facing Macs, systems handling untrusted files or messages, and devices that cannot rely on additional network controls. Until independent technical analysis is available, these CVEs should be considered important patching issues, but the precise “top three” ranking remains uncertain.

 

[Zero Knowledge]

Ahhh A.I bugapocalypse is here!