Fuzzing ImageIO
Summary: Project Zero's Samuel Groß fuzzed Apple's ImageIO framework, which parses images on interactionless code paths in popular messenger apps, and found multiple vulnerabilities that were reported to Apple or the relevant open source maintainers and subsequently fixed. The issues included an out-of-bounds heap write in JPEG parsing, out-of-bounds reads in DDS and OpenEXR handling, and PVR decoder bugs, while separate fuzzing of the bundled OpenEXR library on roughly 500 cores for about two weeks surfaced eight likely unique vulnerabilities fixed in release 2.4.1.
Why it matters: The code that decrypts an incoming message and builds a notification thumbnail turns Apple's image parsers into 0click attack surface, and the researcher notes the preconditions for exploiting a memory corruption bug - automatic delivery receipts, per-boot ASLR, and auto-restarting services - are all satisfied in that scenario.
Read the original at Google Project Zero ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026