CVE-2026-64722: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-64722 Overview

CVE-2026-64722 is a buffer overflow vulnerability affecting Apple iOS, iPadOS, and macOS. Processing a maliciously crafted 3D model can trigger the flaw and disclose process memory to an attacker. The issue is classified under [CWE-120] (Buffer Copy without Checking Size of Input) and requires local access with user interaction. Apple addressed the vulnerability with improved memory handling in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, and macOS Tahoe 26.6. No public exploits or proof-of-concept code have been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation leaks sensitive process memory contents, which may include pointers, cryptographic material, or other confidential data that facilitates further attacks.

Affected Products

Apple iOS versions prior to 26.6
Apple iPadOS versions prior to 26.6
Apple macOS Sequoia prior to 15.7.8 and macOS Tahoe prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-64722 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64722

Vulnerability Analysis

The vulnerability resides in Apple's 3D model processing code path, which is shared across iOS, iPadOS, and macOS. When the operating system parses a specially crafted 3D model file, an out-of-bounds memory read occurs during buffer handling. The overflow does not corrupt memory in a way that enables code execution, but it does expose adjacent process memory to the caller. Apple's advisories describe the fix as improved memory handling, indicating that bounds checks were added or hardened in the affected parser.

The flaw exposes information only, without impacting integrity or availability. An attacker must deliver a malicious 3D model to the victim and induce the target application to process it. Common triggers include preview functionality, AR/VR pipelines, and applications that render USDZ or similar 3D asset formats through system frameworks.

Root Cause

The root cause is insufficient bounds validation when copying data during 3D model parsing, consistent with [CWE-120]. The parser reads beyond the intended buffer length and returns adjacent heap or stack contents to caller-accessible structures.

Attack Vector

Exploitation requires local delivery of a crafted 3D model and user interaction to open or preview the file. A remote attacker can indirectly trigger the flaw by sending the file via messaging, email, or a website that auto-previews attachments. The attacker gains no privilege escalation, but the disclosed memory may accelerate follow-on exploitation of other vulnerabilities.

No verified exploitation code is publicly available. Refer to the Apple Security Advisory 128066, Apple Security Advisory 128067, and Apple Security Advisory 128071 for authoritative technical details.

Detection Methods for CVE-2026-64722

Indicators of Compromise

Unexpected crashes or abnormal termination of processes that render 3D content, such as QuickLookUIService, Preview, or ModelIO-linked applications
Receipt of unsolicited 3D model files (.usdz, .obj, .abc) from untrusted senders through messaging or email
Anomalous memory pressure or repeated preview attempts on the same 3D asset

Detection Strategies

Inventory endpoints running iOS, iPadOS, and macOS versions below the patched releases and flag them for prioritized remediation
Monitor endpoint telemetry for crash reports referencing 3D model parsing frameworks such as ModelIO or SceneKit
Correlate file transfers of 3D model formats with subsequent process anomalies on the receiving device

Monitoring Recommendations

Enable centralized crash reporting on managed Apple fleets and forward reports to the SIEM for review
Track OS version compliance through MDM and alert on devices that fall behind the current security baseline
Review inbound email and messaging gateways for 3D model attachments and quarantine samples from untrusted origins

How to Mitigate CVE-2026-64722

Immediate Actions Required

Deploy iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, or macOS Tahoe 26.6 to all affected devices
Use mobile device management (MDM) to enforce the minimum OS version and block noncompliant devices from sensitive resources
Instruct users to avoid opening 3D model files from untrusted senders until patches are applied

Patch Information

Apple released fixes on the advisories linked as Apple Security Advisory 128066, Apple Security Advisory 128067, and Apple Security Advisory 128071. The updates apply improved memory handling to the 3D model processing routines and eliminate the out-of-bounds condition.

Workarounds

Disable automatic previewing of 3D model attachments in email and messaging clients where feasible
Restrict installation of third-party applications that process 3D assets on managed devices until patching is complete
Segment high-value users onto devices that have already received the patched OS release

bash

# Verify installed macOS version on a managed endpoint
sw_vers -productVersion

# Verify installed iOS/iPadOS version via MDM query (example: jamf)
# Compare the reported OS_VERSION attribute against 26.6