#imessage
-
One Pixel Too Many: A 0-Click Flaw in Apple's EXR Decoder
An ironPeak researcher details CVE-2026-86869: Apple's EXR image decoder on iOS, iPadOS and macOS overran a heap buffer, and the attack could be delivered over iMessage without a single tap.