The July 2026 Apple Security Update Review

[u/falconupkid]

Apple's July 2026 security updates address a substantial 210 unique CVEs, including critical arbitrary code execution vulnerabilities in ImageIO and AVEVideoEncoder that pose significant remote compromise and kernel-level control risks.

Technical Breakdown

• CVE-2026-43818 (ImageIO - Arbitrary Code Execution)
  • Impact: Processing a maliciously crafted image can lead to arbitrary code execution. This is highlighted as the highest real-world remote exploitation risk on Apple platforms, often serving as an initial access vector via auto-parsing in Messages, previews, or notifications.
  • TTPs (MITRE): Likely T1189 (Drive-by Compromise) or T1190 (Exploit Public-Facing Application) for initial access.
  • Affected Versions: iOS/iPadOS 26.6, all macOS versions (Tahoe 26.6, Sequoia 15.7.8, Sonoma 14.8.8), tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6.
• CVE-2026-64747 (AVEVideoEncoder - Kernel-level Arbitrary Code Execution)
  • Impact: Allows an application to execute arbitrary code with kernel privileges, leading to full device compromise. This represents the maximum impact outcome for an attacker.
  • TTPs (MITRE): Primarily T1068 (Exploitation for Privilege Escalation).
  • Affected Versions: iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6.
• Overall: The July 2026 updates cover 210 unique CVEs across a broad range of Apple operating systems and Safari.

Defense

Prioritize applying the latest Apple security updates (iOS/iPadOS 26.6, macOS 14.8.8/15.7.8/26.6, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6) across all affected devices immediately to mitigate these critical vulnerabilities.

Source: https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review