CVE-2026-64752

CVE-2026-64752 is a memory corruption vulnerability in Apple's image processing code that is triggered when a device processes a maliciously crafted image, potentially via vectors such as received messages, email attachments, or web content. Successful exploitation can lead to arbitrary code execution on the affected device, meaning an attacker could run their own code in the context of the image-processing component. The flaw affects iPhones, iPads, Macs, and Apple Vision Pro headsets running operating system versions prior to the fixed releases, and it was remediated by removing the vulnerable code entirely. The fix shipped in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 as part of a broader batch of roughly 200 patched vulnerabilities. There is no CVSS score yet, no known public proof of concept, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Update all Apple devices to iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27 as soon as possible via Settings > General > Software Update, and use MDM to push the update across managed fleets. Until patched, advise users to avoid opening unsolicited images from unknown senders in Messages, Mail, and on the web. Monitor Apple's security advisories and the CISA KEV list for any change in exploitation status.