CVE-2026-64725: Apple iPadOS Denial-of-Service Vulnerability

CVE-2026-64725 Overview

CVE-2026-64725 is an out-of-bounds write vulnerability [CWE-787] affecting multiple Apple operating systems. A malicious app can trigger a memory corruption condition that causes a denial-of-service. Apple addressed the flaw with improved bounds checking across its OS family.

The issue impacts iOS, iPadOS, macOS Sequoia, macOS Sonoma, macOS Tahoe, tvOS, visionOS, and watchOS. Local attack access with user interaction is required for exploitation. No public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact
A local application can write outside allocated memory bounds and cause a denial-of-service on affected Apple devices, disrupting availability across consumer and enterprise endpoints.

Affected Products

Apple iOS and iPadOS (fixed in 26.6)
Apple macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6
Apple tvOS 26.6, visionOS 26.6, and watchOS 26.6

Discovery Timeline

2026-07-27 - CVE-2026-64725 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64725

Vulnerability Analysis

CVE-2026-64725 is classified as an out-of-bounds write [CWE-787]. The flaw exists in an unspecified component shared across Apple's operating systems. An application running locally on the device can trigger a write operation that exceeds the intended buffer boundary.

Out-of-bounds writes corrupt adjacent memory structures. In this case, the corruption leads to a denial-of-service condition rather than confidentiality or integrity loss. Apple's advisories confirm the impact is limited to availability, and the fix consists of improved bounds checking in the affected code path.

Exploitation requires user interaction, meaning the victim must launch or interact with the malicious app. The scope remains unchanged, indicating the impact is confined to the vulnerable process context.

Root Cause

The root cause is missing or insufficient bounds validation before a memory write. When the vulnerable code processes attacker-controlled input, it writes beyond the allocated buffer. Apple's patch introduces stricter bounds checking to reject or truncate oversized inputs before the write occurs.

Attack Vector

An attacker must first deliver a malicious app to the target device through the App Store, TestFlight, sideloading, or an MDM-managed distribution channel. Once installed and launched by the user, the app issues crafted input to the vulnerable API. The resulting out-of-bounds write crashes the affected process or system component, producing a denial-of-service.

No verified proof-of-concept code is publicly available. See the Apple security advisories for technical details specific to each platform.

Detection Methods for CVE-2026-64725

Indicators of Compromise

Repeated crash reports referencing memory access violations from a specific third-party application on Apple endpoints.
Unexpected system component restarts or service termination shortly after launching a newly installed app.
Diagnostic logs containing EXC_BAD_ACCESS or heap corruption entries tied to the vulnerable process.

Detection Strategies

Ingest Apple unified logs and crash reports into your SIEM and alert on abnormal crash frequency by app bundle identifier.
Track installations of unsigned or newly published applications on managed Apple devices via your MDM inventory.
Correlate application launch events with subsequent process termination or kernel panic events to identify exploitation attempts.

Monitoring Recommendations

Monitor endpoint telemetry for crash patterns consistent with memory corruption on macOS, iOS, and iPadOS fleets.
Track OS version compliance to identify devices still running pre-26.6 or pre-15.7.8 builds.
Review MDM logs for sideloaded or enterprise-signed apps that appear on multiple devices in a short window.

How to Mitigate CVE-2026-64725

Immediate Actions Required

Update all Apple devices to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6.
Enforce automatic updates through MDM policies on managed fleets to reduce patch lag.
Audit installed applications and remove untrusted or unnecessary third-party apps.
Restrict sideloading and enterprise app installation to vetted publishers only.

Patch Information

Apple has released patches across all affected platforms. Refer to the Apple Security Advisory 128066, Apple Security Advisory 128067, Apple Security Advisory 128068, Apple Security Advisory 128069, Apple Security Advisory 128070, Apple Security Advisory 128071, and Apple Security Advisory 128072 for platform-specific details.

Workarounds

No vendor-provided workaround exists; applying the security update is the only supported remediation.
As a temporary control, block installation of untrusted apps via MDM configuration profiles until patching completes.
Limit user privileges to prevent installation of arbitrary applications on managed endpoints.

bash

# Example: verify macOS build version after patching
sw_vers -productVersion
# Expected output for Sequoia: 15.7.8
# Expected output for Sonoma:  14.8.8
# Expected output for Tahoe:   26.6