CVE-2026-64764 – Apple iOS and iPadOS
“A single malformed file should never be enough to put a device at risk.”
This update addresses multiple vulnerabilities affecting Apple iOS and iPadOS. CVE-2026-64763, CVE-2026-64764, CVE-2026-64765, CVE-2026-64766, and CVE-2026-43776 each have a CVSS score of 7.8, which is High severity. CVE-2026-43818 has a CVSS score of 8.8, which is also High severity. No verified real-world exploitation has been reported for these vulnerabilities.
The vulnerabilities include out-of-bounds writes, integer overflows, and a buffer overflow that can be triggered by processing a maliciously crafted file or image. Successful exploitation may result in unexpected application termination or arbitrary code execution. Apple addressed these issues through improved bounds checking, improved input validation, and removal of vulnerable code. The fixes are included in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 (where applicable), macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.
Key Details
- Affected Product
- Apple Ipados
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-787