The picture is the payload

Why a decoder is an attack surface

A decoder takes a file from an unknown source and acts on its contents. If the file is crafted so that the program misreads its own boundaries, an attacker can sometimes make it run their code. Decoders handle many formats and run on files that arrive without invitation. A flaw in one needs no mistake by the owner.

That is why some of the most serious chains documented in recent years needed no tap. Google’s Threat Intelligence Group counted 15 mobile operating system zero-days exploited in 2025, up from 9 in 2024, and noted that several chains combined three or more flaws[S13]. Parsers are one route among them, not the only one.

August 2025: a messaging flaw and an image flaw

On 29 August 2025 WhatsApp published an advisory about a flaw in how it handled linked-device messages. It let an unrelated sender make a target’s phone process content from an arbitrary web address. Combined with an Apple Image I/O flaw, an out-of-bounds write triggered by a malicious image, it was used against a small number of people, reportedly dozens, with no interaction required[S1].

WhatsApp told affected users to factory reset their phones and keep the system and app updated[S1]. Because the image flaw sits in the operating system, removing the app did not remove the exposure[S1]. No actor was publicly attributed, and WhatsApp named none.

LANDFALL: a photo with something appended

In November 2025 Palo Alto Networks’ Unit 42 described Android spyware it calls LANDFALL, hidden in malformed DNG photos that exploited a flaw in a Samsung image library. Samsung patched the flaw in April 2025. Unit 42 found samples dated from July 2024 to February 2025, and the picture files carried extra data appended to the end[S2].

Unit 42 says the files were named like WhatsApp images, which suggests delivery by messaging, but it could not confirm a zero-click path. It names no vendor, and notes the geography it saw comes from sample metadata, not from victims[S2].

Research at the edges

Not every decoder flaw is found by attackers. Four 2025 and 2026 cases came from researchers, and none was described as exploited.

An independent researcher reported an Apple EXR image-decoder flaw in May 2026, fixed in iOS 27. The researcher says it is a heap overflow reachable by an image sent over iMessage and decoded in the background during indexing and thumbnailing, and that Apple’s message-isolation layer does not handle that format. Full code execution was not demonstrated, and there is no evidence of use[S3]. A public database entry scores it lower and says user interaction is required, which conflicts with the zero-click description[S4].

Google Project Zero disclosed a Dolby audio-decoder flaw in October 2025. It showed code execution on a Pixel 9 and crashes on other devices, because Android decodes received audio locally; fixes reached Pixel in December 2025 and Android generally in January 2026, with no in-the-wild use reported[S5].

Apple’s iOS 26.6.1 on 17 August 2026 fixed an ImageIO integer overflow, credited to a Meta researcher, that could allow code execution when an image is processed. Apple did not say it was exploited. A commentary from Jamf in The Register called image parsing a common spyware path, which is an opinion, not an attribution [S6][S7]. iOS 27 credits Google Project Zero for another ImageIO write flaw, reachable through a crafted image[S8].

Why previews and thumbnails matter

The sharpest case is Apple’s September 2026 fix for a CoreGraphics flaw that a crafted file can trigger. Apple says it may have been used in an extremely sophisticated attack on specific people on versions before iOS 27[S11]. Calif’s analysis found that its public crash file is reached through the thumbnail path apps use to preview received attachments, so previewing may be enough[S12]. How the real attackers delivered it is unknown, and a zero-click route is unconfirmed.

An older case shows the same lesson. Google Project Zero’s 2021 analysis of FORCEDENTRY found a file with a picture extension that was actually a PDF; the phone identified it by its content, passed it to a parser and reached code execution with no user interaction[S9]. Kaspersky’s 2023 account of Operation Triangulation found the attacker’s message and attachment had been deleted afterward[S10].

What vendors have changed

The fixes are mostly patches, and speed matters. The researcher behind the EXR report noted that Apple’s isolation layer for messages does not cover that format[S3]. On Android, media-component flaws arrive through monthly bulletins; the Dolby flaw went from disclosure in October 2025 to a general Android fix in January 2026[S5]. We describe these as patterns in the sources, not as a verdict on any vendor.

Our assessment: three patterns

Three patterns run through the cases. First, the weakness is rarely the format itself but the amount of code that handles it: images, audio, fonts and PDFs each pass through system libraries on their way to the screen. Second, the cases reported as used in attacks combined the decoder flaw with something else, a second flaw in the WhatsApp chain and a loader in LANDFALL [S1][S2]; in those cases a decoder bug was a foothold, not the whole attack. Third, researchers found most of the flaws first, and the patch record shows vendors can respond. The risk is concentrated in the interval between a fix and an install.

What the Lab is watching

We are watching three things.

First, whether the EXR and ImageIO reports are matched by Apple advisories saying anything about exploitation.

Second, whether Unit 42's open question about a zero-click path for LANDFALL[S2] is ever settled.

Third, whether more formats follow the same path, since each new media type is a new parser. We will date any change.

What this means for examiners

Ask for each phone’s operating system and app versions and the dates of its last updates. For an estate, the question is how fast devices update after a media-component fix, because a published fix shows everyone where the flaw was; Calif’s September 2026 analysis began from a comparison of two Apple releases[S12]. Keep received files and message records where they exist. A file used in an attack may have been deleted by the exploit, so its absence tells you little.

Four questions suit any estate. Which phones are more than one security release behind? How quickly did the last media-component fix reach them? Which messaging and mail apps preview attachments automatically? And which phones belong to people with reason to expect targeting, for whom Lockdown Mode, or Android’s Advanced Protection, is worth the inconvenience?

What we could not confirm

We could not confirm a zero-click path for LANDFALL, the delivery of the CoreGraphics attack, or exploitation of the EXR, Dolby and August 2026 ImageIO flaws.