Apple Patches Critical Integer Overflow in macOS ImageIO SGI File Parsing (CVE-2026-20675)

Apple has released a security update to address CVE-2026-20675, a critical integer overflow vulnerability in the macOS ImageIO framework that could allow remote code execution via specially crafted SGI image files. The flaw, disclosed by the Zero Day Initiative (ZDI) on March 10, 2026, carries a CVSS score of 7.8 and was reported by researcher George Karchemsky.

The vulnerability resides in the ImageIO framework, which handles image file parsing across macOS. The specific issue stems from improper validation of user-supplied data when processing SGI (Silicon Graphics Image) files. This lack of validation can trigger an integer overflow before writing to memory, enabling an attacker to execute arbitrary code in the context of the current process. Exploitation requires user interaction, such as opening a malicious image file or viewing it in an application that relies on ImageIO.

Apple has issued a security update to correct the vulnerability, with details available on the company's support page. The update is part of Apple's ongoing efforts to patch security flaws in its operating system and frameworks. Users are strongly advised to apply the update promptly to mitigate the risk of exploitation.

The impact of this vulnerability is significant given the widespread use of macOS across consumer and enterprise environments. ImageIO is a core component used by numerous applications for image rendering, making it a potential vector for targeted attacks. While no active exploitation has been reported in the wild, the public disclosure of technical details increases the likelihood of attackers developing exploits.

This vulnerability highlights the ongoing challenges in securing complex media parsing libraries, which have historically been a rich target for attackers. Integer overflow flaws in image parsers have been exploited in the past to deliver malware or gain initial access to systems. Apple's patch addresses this specific issue, but users should remain vigilant about keeping their systems updated.

The coordinated disclosure timeline shows that the vulnerability was reported to Apple on December 5, 2025, with the public advisory released on March 10, 2026. This three-month window allowed Apple to develop and test the fix before disclosure. The ZDI advisory credits Karchemsky for discovering the flaw, underscoring the role of independent researchers in improving software security.

In the broader context, this patch joins a series of recent Apple security updates addressing vulnerabilities in various components, including those in WebKit and other frameworks. Users should ensure they are running the latest version of macOS to benefit from these fixes. For enterprise environments, IT administrators should prioritize deploying the update across managed devices to reduce exposure to potential attacks.