CVE-2026-64758: Apple iPadOS DOS Vulnerability

CVE-2026-64758 Overview

CVE-2026-64758 is an out-of-bounds memory access vulnerability affecting multiple Apple operating systems. The flaw allows a maliciously crafted file to trigger unexpected application termination when processed by a vulnerable system component. Apple addressed the issue with improved bounds checks across its platform lineup. The weakness is classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer. Local attack conditions apply, and user interaction is required to open or process the malicious file. Apple has released fixes in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

Critical Impact
Processing a maliciously crafted file may trigger memory corruption leading to application termination and potential compromise of confidentiality, integrity, and availability on affected Apple devices.

Affected Products

Apple iOS and iPadOS prior to 26.6
Apple macOS Tahoe prior to 26.6
Apple tvOS, visionOS, and watchOS prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-64758 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-64758

Vulnerability Analysis

CVE-2026-64758 stems from improper bounds checking during file processing within an Apple platform component shared across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. When the vulnerable parser encounters a malformed file, it reads or writes memory outside the allocated buffer. The condition maps to [CWE-119], an improper restriction of operations within the bounds of a memory buffer. Successful triggering causes unexpected app termination and creates conditions that could be leveraged for further exploitation.

Root Cause

The root cause is missing or insufficient boundary validation on data extracted from an attacker-controlled file. Apple's remediation description explicitly cites "improved bounds checks," confirming that the parser trusted length or offset fields from the file without verifying them against buffer sizes. This class of defect frequently underlies memory corruption issues in media, document, and archive parsers.

Attack Vector

Exploitation requires an attacker to deliver a crafted file to the target user through email, messaging, web download, or synced content. The user must open or otherwise cause the file to be processed by the vulnerable component. The attack requires local access to the file processing context and user interaction, but no elevated privileges. A successful attack terminates the affected application and may enable follow-on memory corruption exploitation.

No public proof-of-concept exploit code is available for CVE-2026-64758. Refer to the Apple Security Advisory #128066 for vendor technical detail.

Detection Methods for CVE-2026-64758

Indicators of Compromise

Unexpected termination or repeated crash reports referencing file parsing components across iOS, iPadOS, macOS, tvOS, visionOS, or watchOS.
Crash logs in ~/Library/Logs/DiagnosticReports/ on macOS showing out-of-bounds access signatures in media, document, or archive handlers.
Delivery of suspicious file attachments via Messages, Mail, AirDrop, or web downloads immediately preceding app crashes.

Detection Strategies

Collect and analyze macOS and iOS crash reports for exception types EXC_BAD_ACCESS and SIGSEGV correlated with file open events.
Monitor endpoint telemetry for anomalous file downloads followed by application crash events on unpatched Apple devices.
Inventory Apple endpoints and flag devices running OS versions below 26.6 as exposed until patched.

Monitoring Recommendations

Track Apple OS version compliance in mobile device management (MDM) and endpoint inventory dashboards.
Alert on repeated application crashes tied to the same user or file source, which may indicate exploitation attempts.
Correlate email and web gateway telemetry with endpoint crash events to identify malicious file delivery patterns.

How to Mitigate CVE-2026-64758

Immediate Actions Required

Update all Apple devices to iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6.
Enforce automatic OS updates through MDM policies for enterprise-managed fleets.
Instruct users to avoid opening files from untrusted sources until patches are applied.

Patch Information

Apple has published fixes in the following advisories: Apple Security Advisory #128066, Apple Security Advisory #128067, Apple Security Advisory #128068, Apple Security Advisory #128069, and Apple Security Advisory #128070. The fix introduces improved bounds checks in the affected component. Apply the corresponding platform update on every managed device.

Workarounds

Restrict processing of untrusted files, especially from unknown senders in Mail, Messages, and AirDrop.
Disable auto-preview of attachments in messaging clients where feasible.
Use MDM configuration profiles to block risky file-sharing channels on managed devices until patching completes.

bash

# Verify macOS version compliance
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart