Vulnerability Spotlight: Apple Remote Code Execution With Image Files

Summary: Cisco Talos disclosed five remote code execution vulnerabilities in Apple OS X image processing: TALOS-2016-0171, TALOS-2016-0180, TALOS-2016-0181, TALOS-2016-0183 and TALOS-2016-0186, affecting tiled TIFF, OpenEXR, Digital Asset Exchange and BMP files handled by the Image I/O, Scene Kit and Core Graphics APIs. The flaws affect OS X 10.11.5 and iOS 9.3.2 and are believed present in all previous versions, with TALOS-2016-0183 patched in OS X 10.11.5.
Why it matters: A crafted image can trigger these flaws in any application using the affected Apple APIs, and because apps such as iMessage render images automatically in their default configurations, exploitation may not require the user to click anything.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026