CVE-2026-64747: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-64747 Overview

CVE-2026-64747 is a buffer overflow vulnerability affecting multiple Apple operating systems, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple addressed the issue with improved size validation. A locally installed application can leverage the flaw to execute arbitrary code with kernel privileges, resulting in a complete compromise of the affected device. The weakness is categorized under CWE-120 (Buffer Copy without Checking Size of Input). Apple published fixes across its product line in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

Critical Impact
A malicious application can escalate to kernel privileges and execute arbitrary code, breaking the sandbox and enabling full device compromise.

Affected Products

Apple iOS and iPadOS prior to 26.6
Apple macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, macOS Tahoe prior to 26.6
Apple tvOS, visionOS, and watchOS prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-64747 published to the National Vulnerability Database
2026-07-29 - CVE-2026-64747 last modified in NVD

Technical Details for CVE-2026-64747

Vulnerability Analysis

CVE-2026-64747 is a memory corruption issue in the Apple kernel. According to Apple's advisory, the flaw was fixed by adding improved size validation to a code path that previously copied attacker-controlled data without verifying its length against the destination buffer. When triggered, the out-of-bounds write corrupts adjacent kernel memory. Successful exploitation grants arbitrary code execution in kernel context, the highest privilege level on the affected operating systems.

Because the vulnerable path resides in the kernel, exploitation bypasses the application sandbox and standard user-space privilege boundaries. An attacker who chains this bug with a delivery vector such as a malicious app can pivot from unprivileged code to full kernel control, enabling persistence, credential theft, and disablement of platform defenses.

Root Cause

The root cause is missing or insufficient size checking before a memory copy operation in a kernel component ([CWE-120]). Attacker-supplied input exceeds the fixed-size destination buffer, overwriting adjacent kernel data structures. Apple's remediation adds explicit bounds validation prior to the copy.

Attack Vector

The attack vector is local. An attacker must have code execution on the device, typically by convincing a user to install or run a malicious application. No elevated privileges are required prior to exploitation, but user interaction to launch the app is expected. Remote exploitation is not indicated in the vendor advisory.

Specific proof-of-concept code is not publicly available at the time of writing, and no exploitation in the wild has been reported. See the Apple Security Advisory #128066 and related advisories for vendor technical details.

Detection Methods for CVE-2026-64747

Indicators of Compromise

Unexpected kernel panics or system reboots on Apple endpoints running vulnerable OS versions
Newly installed applications that request unusual entitlements or spawn child processes with elevated privileges
Anomalous kernel extension or system extension load events shortly after app launch

Detection Strategies

Inventory endpoints and identify Apple devices running OS builds earlier than the patched versions listed by Apple
Correlate crash reports (/Library/Logs/DiagnosticReports/) and MDM telemetry for repeated kernel faults tied to a specific application
Monitor App Store installs and sideloaded profiles on managed macOS and iOS fleets for untrusted publishers

Monitoring Recommendations

Ingest macOS Unified Log and Endpoint Security Framework (ESF) telemetry into a centralized analytics platform for behavioral analysis
Alert on processes that trigger kernel task port requests, task_for_pid on privileged targets, or unusual IOKit interactions
Track patch compliance rates for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across the estate

How to Mitigate CVE-2026-64747

Immediate Actions Required

Update to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6
Enforce OS update policies through MDM to reach non-compliant devices
Restrict installation of unsigned or sideloaded applications on managed endpoints
Review recently installed applications on unpatched devices for suspicious behavior

Patch Information

Apple has released patches across its operating system portfolio. Refer to the vendor advisories for build-level detail: Apple Security Advisory #128066, #128067, #128068, #128069, #128070, #128071, and #128072.

Workarounds

No vendor-provided workaround exists; applying the OS update is the only supported fix
Limit app installation sources to the App Store and vetted enterprise catalogs until patches are deployed
Enable Lockdown Mode on high-risk iOS, iPadOS, and macOS devices to reduce attack surface for untrusted content

bash

# Verify current macOS build and prompt for available updates
sw_vers
softwareupdate --list
sudo softwareupdate --install --all --restart