CVE-2026-64760: Apple iPadOS Information Disclosure Flaw

CVE-2026-64760 Overview

CVE-2026-64760 is an information disclosure vulnerability affecting Apple iOS and iPadOS. A local application can leak sensitive kernel state through insufficient validation in an affected code path. Apple addressed the issue with additional validation in iOS 18.7.10 and iPadOS 18.7.10.

The weakness maps to [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Exploitation requires an attacker to run code locally on the device, typically through a malicious or compromised application. Successful exploitation exposes kernel memory contents that can be used to bypass Kernel Address Space Layout Randomization (KASLR) and support follow-on exploitation chains.

Critical Impact
A malicious app running on an unpatched iOS or iPadOS device can read sensitive kernel state, undermining kernel memory protections and aiding privilege escalation chains.

Affected Products

Apple iOS versions prior to 18.7.10
Apple iPadOS versions prior to 18.7.10
Devices running the vulnerable Apple kernel components

Discovery Timeline

2026-08-17 - CVE-2026-64760 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-64760

Vulnerability Analysis

The vulnerability is an information leakage in Apple's kernel components on iOS and iPadOS. According to Apple's advisory, the issue was addressed by adding validation to a code path that previously returned or exposed data derived from kernel state. An application running with normal user-level entitlements can invoke the affected path and observe residual kernel information.

Information of this class typically includes kernel pointers, addresses of kernel objects, or uninitialized structure fields. Attackers use these values to defeat KASLR and to construct reliable exploits for other memory-corruption bugs. The vulnerability does not directly grant code execution, but it removes a key mitigation that isolates the kernel from user-space applications.

Root Cause

The root cause is missing validation on data returned from a kernel interface to a user-space caller. Without checks that sanitize or restrict the returned values, kernel-resident state crosses the security boundary between the kernel and the calling application. Apple's fix introduces the additional validation required to prevent that leak.

Attack Vector

Exploitation is local. An attacker must be able to execute code on the target device, most commonly by convincing a user to install a malicious application or by leveraging another vulnerability inside a sandboxed app. No user interaction beyond running the app is required. The attack does not modify data and does not affect availability; its impact is confined to confidentiality of kernel state.

Because the affected interface is reachable from a standard application context, the vulnerability is particularly useful as the first stage of a multi-CVE exploit chain that targets the kernel.

Detection Methods for CVE-2026-64760

Indicators of Compromise

Installation of unsigned, sideloaded, or enterprise-signed applications from untrusted developers on managed devices.
Applications making unusually high volumes of low-level system calls that query kernel state.
Devices reporting iOS or iPadOS versions earlier than 18.7.10 in mobile device management (MDM) inventory.

Detection Strategies

Query MDM and unified endpoint management tooling for devices running iOS or iPadOS builds prior to 18.7.10 and flag them as vulnerable.
Review Apple crash reports and diagnostic logs for repeated faults in kernel interfaces used by third-party apps.
Correlate App Store installation events with subsequent anomalous system behavior on the same device.

Monitoring Recommendations

Continuously monitor iOS and iPadOS OS versions across the fleet and enforce a minimum supported build.
Alert on newly installed applications that request entitlements or APIs inconsistent with the app's stated purpose.
Track Apple security advisories and correlate published CVEs against installed application and OS inventory.

How to Mitigate CVE-2026-64760

Immediate Actions Required

Update all iPhone and iPad devices to iOS 18.7.10 or iPadOS 18.7.10, or a later release that includes the fix.
Enforce the minimum OS version through MDM compliance policies and block noncompliant devices from corporate resources.
Audit installed applications and remove software from untrusted or unknown developers.

Patch Information

Apple released the fix in iOS 18.7.10 and iPadOS 18.7.10. Details are documented in the Apple Support Document for this update. Administrators should validate that automatic updates are enabled and that supervised devices receive the update through MDM-managed update policies.

Workarounds

Restrict application installation to vetted sources and disable sideloading where organizational policy permits.
Apply MDM restrictions that limit installation of unmanaged applications on corporate-owned devices.
Educate users to avoid installing applications from untrusted developers until the OS update is applied.

bash

# Example MDM compliance query: identify iOS/iPadOS devices below the patched build
# Pseudocode - adapt to your MDM's query language
SELECT device_id, user, os_version
FROM managed_devices
WHERE platform IN ('iOS','iPadOS')
  AND os_version < '18.7.10';