CVE-2026-64736

CVE-2026-64736 is an out-of-bounds read/write flaw (CWE-125/CWE-787) in Apple's kernel, fixed by improved bounds checking. It is triggered locally by an app already running on the device, which may be able to read kernel memory or corrupt it, causing unexpected system termination or a device crash. The CVSS 3.1 score is 7.1 (high) with a local attack vector, low privileges required, and no user interaction, meaning any malicious or compromised app on an unpatched device is a potential vector. All users on versions prior to the fixes across iOS, iPadOS, macOS Sequoia and Tahoe, tvOS, visionOS, and watchOS are affected. No public proof of concept is known, the flaw is not listed in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Patch all Apple devices to iOS/iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, or watchOS 27 as soon as possible, prioritizing managed enterprise fleets via MDM. Because exploitation requires a local app, review and restrict sideloaded, untrusted, or out-of-date third-party apps, and audit recently installed enterprise apps for anomalous crash or kernel-panic behavior.