CVE-2026-64745: Apple macOS Information Disclosure Flaw

CVE-2026-64745 Overview

CVE-2026-64745 is a lock screen authentication bypass in Apple macOS that allows a person with physical access to a locked device to view contacts and photos. Apple addressed the issue by adding restrictions on the lock screen. The flaw is tracked under CWE-287: Improper Authentication and requires local physical access, not remote exploitation. Apple resolved the issue in macOS Sequoia 15.7.8 and macOS Tahoe 26.6.

Critical Impact
An attacker with physical access to a locked Mac can retrieve user contacts and photos without authenticating, exposing personally identifiable information stored on the device.

Affected Products

Apple macOS versions prior to Sequoia 15.7.8
Apple macOS versions prior to Tahoe 26.6
Devices running affected macOS builds regardless of hardware model

Discovery Timeline

2026-07-27 - CVE-2026-64745 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-64745

Vulnerability Analysis

CVE-2026-64745 is an improper authentication weakness in the macOS lock screen. The lock screen failed to fully restrict access to certain user data surfaces while the device remained locked. As a result, an unauthenticated user with hands-on access could reach contact records and photo content without providing valid credentials.

The issue is limited by its attack vector. Exploitation requires physical proximity to the target device, low complexity, no privileges, and no user interaction. Only confidentiality is affected; integrity and availability are not impacted. The EPSS probability sits at 0.136%, consistent with a physically bounded issue that does not scale as a mass exploitation risk.

Root Cause

The root cause is insufficient enforcement of authentication state on lock screen surfaces that expose user data. Certain views tied to contacts and photo previews did not gate access behind full unlock, letting a locked-session interaction reveal protected content.

Attack Vector

An attacker requires physical possession of a locked Mac. Through interactions available at the lock screen, the attacker triggers the exposed surfaces and reads contact entries and photo items. The bypass does not yield code execution, persistence, or system modification. It is strictly an information disclosure condition scoped to on-device data reachable from the pre-authentication UI.

Because no code examples were published with the advisory, defenders should treat the risk as a physical-access data exposure rather than a remote exploitation scenario. See the Apple advisories at Apple Security Update 128067 and Apple Security Update 128071 for vendor detail.

Detection Methods for CVE-2026-64745

Indicators of Compromise

No network-based indicators exist; exploitation is local and leaves minimal forensic residue on the host.
Unexplained physical access events, such as a device left unattended and later found with an altered lock screen state, may be the only signal.
Unified log entries showing contacts or photos UI activity during periods when no valid unlock occurred.

Detection Strategies

Correlate macOS unified logging events for contactsd and photolibraryd activity against successful loginwindow authentication events.
Flag hosts running macOS builds earlier than Sequoia 15.7.8 or Tahoe 26.6 through endpoint inventory queries.
Review MDM compliance reports for devices that have not applied the July 2026 Apple security updates.

Monitoring Recommendations

Track OS version drift across the macOS fleet and alert when devices remain on vulnerable builds beyond the patch window.
Monitor physical security controls for shared, kiosk, or executive devices most exposed to opportunistic access.
Ingest macOS endpoint telemetry into a centralized data lake to enable historical review of lock screen and privacy-scoped process activity.

How to Mitigate CVE-2026-64745

Immediate Actions Required

Update all Mac endpoints to macOS Sequoia 15.7.8 or macOS Tahoe 26.6 through Software Update or MDM-managed deployment.
Prioritize patching for devices used in public spaces, shared workstations, and travel scenarios where physical access risk is highest.
Verify patch installation with sw_vers -productVersion and reconcile results against the asset inventory.

Patch Information

Apple released fixes in macOS Sequoia 15.7.8 and macOS Tahoe 26.6. The fix adds additional restrictions on the lock screen to block access to contacts and photos while the device remains locked. Refer to Apple Security Update 128067 and Apple Security Update 128071 for release notes and applicability.

Workarounds

Enforce short screen lock timeouts and require password immediately after sleep or screen saver via configuration profile.
Enable FileVault full-disk encryption so that powered-off or restarted devices require credentials before any user data surface loads.
Restrict lock screen widgets and notification previews for Contacts and Photos through MDM policy until patches are applied.
Physically secure unattended devices and apply organizational policies against leaving Macs unlocked in shared environments.

bash

# Verify installed macOS version against fixed builds
sw_vers -productVersion

# Trigger managed software updates on a target host
sudo softwareupdate -ia --restart

# Confirm FileVault status
fdesetup status