CVE-2026-64752: Apple iPadOS RCE Vulnerability

CVE-2026-64752 Overview

CVE-2026-64752 is a memory corruption vulnerability affecting Apple operating systems including iOS, iPadOS, macOS, and visionOS. The flaw exists in image processing code where malformed input can trigger an out-of-bounds write condition [CWE-787]. Apple addressed the issue by removing the vulnerable code path in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27. Successful exploitation allows arbitrary code execution when a user processes a maliciously crafted image. The vulnerability requires local access and user interaction, limiting remote exploitation scenarios. Apple published advisory details across three support pages covering the affected platforms.

Critical Impact
Processing a maliciously crafted image on an unpatched Apple device can lead to arbitrary code execution with high impact to confidentiality, integrity, and availability.

Affected Products

Apple iOS (versions prior to iOS 27)
Apple iPadOS (versions prior to iPadOS 27)
Apple macOS (versions prior to macOS Golden Gate 27)
Apple visionOS (versions prior to visionOS 27)

Discovery Timeline

2026-09-14 - CVE-2026-64752 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-64752

Vulnerability Analysis

The vulnerability resides in an image parsing component shared across Apple's operating systems. When the affected code processes a specially crafted image file, it performs an out-of-bounds write to adjacent memory. Attackers can leverage this corruption to overwrite control data such as function pointers or return addresses, redirecting execution to attacker-controlled payloads.

Apple's advisory indicates the fix removed the vulnerable code entirely rather than patching the boundary logic. This suggests the affected feature was legacy or non-essential functionality that Apple determined could be deprecated. The attack requires local access with low privileges and user interaction, typically opening or previewing an untrusted image.

Exploitation on modern Apple platforms must contend with mitigations including Address Space Layout Randomization (ASLR), Pointer Authentication Codes (PAC) on Apple Silicon, and sandboxing. Despite these protections, image parsers historically provide reliable exploitation primitives due to their exposure to untrusted content across Mail, Messages, Safari, and preview workflows.

Root Cause

The root cause is an out-of-bounds write [CWE-787] in image processing logic. Insufficient validation of image structure fields permitted a write operation to exceed allocated buffer boundaries. Apple's remediation approach of removing the vulnerable code indicates the flawed logic could not be safely retained.

Attack Vector

An attacker delivers a malicious image file to a target user through email, messaging, web content, or file transfer. When the user opens or previews the image on an affected device, the parser triggers the memory corruption. The attacker gains code execution in the context of the process handling the image.

No verified proof-of-concept code is publicly available for CVE-2026-64752. Refer to the Apple Security Advisory for iOS/iPadOS 27, macOS Golden Gate 27, and visionOS 27 for vendor-published details.

Detection Methods for CVE-2026-64752

Indicators of Compromise

Unexpected crashes or ReportCrash entries associated with image rendering processes such as ImageIO, MediaLibraryService, or preview daemons.
Delivery of unsolicited image files via Messages, Mail attachments, or AirDrop from untrusted senders.
Anomalous child processes spawned by image-handling applications shortly after image processing.

Detection Strategies

Monitor endpoint telemetry for process crashes referencing image parsing frameworks on Apple devices.
Correlate image file delivery events with subsequent process anomalies or privilege changes.
Track outbound network connections initiated by user-facing applications after opening image attachments.

Monitoring Recommendations

Aggregate crash reports from managed Apple endpoints through your mobile device management (MDM) telemetry pipeline.
Alert on Apple devices reporting OS versions below iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27.
Review email and messaging gateways for image attachments from unverified senders and apply content inspection.

How to Mitigate CVE-2026-64752

Immediate Actions Required

Update all Apple devices to iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27 immediately.
Enforce patched OS baselines through MDM policies and block non-compliant devices from sensitive resources.
Instruct users to avoid opening image attachments from untrusted or unverified sources until patching completes.

Patch Information

Apple resolved CVE-2026-64752 by removing the vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27. Refer to the vendor advisories at Apple Support 149034, Apple Support 149035, and Apple Support 149038 for release-specific guidance.

Workarounds

Disable automatic image previews in Mail and Messages where operationally feasible.
Restrict AirDrop to contacts-only or disable it entirely on managed devices.
Apply web content filtering to block image downloads from untrusted domains until endpoints are patched.

bash

# Verify installed OS version on macOS
sw_vers -productVersion

# Trigger managed software update via MDM (example using softwareupdate)
sudo softwareupdate --install --all --restart