tfp0https://tfp0.dev/CVE writeups for iOS and macOS. Vulnerability analysis, root causes, and patches.en-USCVE-2026-65395: ImageIO Extended XMP Offset Wrap, a 4 GiB memcpy From a JPEGhttps://tfp0.dev/posts/cve-2026-65395-imageio-extended-xmp/https://tfp0.dev/posts/cve-2026-65395-imageio-extended-xmp/Tue, 06 Oct 2026 00:00:00 +0000CVE-2026-65395 ImageIO: a 32-bit XmpOffset + chunkLength check in _JPEGFile::copyXMPProperties, the 64-bit fix in 23H24, a paired-input replay on iOS 26.4 that faults 10/10, and the candidates that were ruled out.