CVE-2026-64763: Apple iPadOS RCE Vulnerability

CVE-2026-64763 Overview

CVE-2026-64763 is an out-of-bounds write vulnerability [CWE-787] affecting multiple Apple operating systems. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. Apple addressed the flaw by removing the vulnerable code across its platform ecosystem.

The issue impacts iOS, iPadOS, macOS Sequoia, macOS Sonoma, macOS Tahoe, tvOS, visionOS, and watchOS. Exploitation requires local access and user interaction, such as opening a crafted file. Successful exploitation grants high impact on confidentiality, integrity, and availability of the affected device.

Critical Impact
A local attacker who convinces a user to open a crafted file can trigger arbitrary code execution or crash the target application on Apple devices.

Affected Products

Apple iOS and iPadOS (fixed in 26.6)
Apple macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6
Apple tvOS 26.6, visionOS 26.6, and watchOS 26.6

Discovery Timeline

2026-07-27 - CVE-2026-64763 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64763

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition classified under [CWE-787]. Out-of-bounds writes occur when software writes data past the end, or before the beginning, of an intended buffer. This memory corruption can overwrite adjacent data structures, function pointers, or return addresses.

Apple's advisories state the issue was addressed by removing the vulnerable code entirely, rather than adding bounds checks. This suggests the affected parsing routine was deprecated or replaced. The flaw activates during processing of a maliciously crafted file, indicating a file-format parser is the root cause.

Root Cause

The root cause is improper validation of file content boundaries during parsing. When the parser encounters attacker-controlled length or offset fields, it writes data outside the allocated buffer. The exact affected component is not detailed in Apple's public advisories.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a crafted file through email, messaging, or web download. The victim must open or process the file with a vulnerable Apple application. Successful exploitation yields arbitrary code execution within the context of the processing application.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.129%, indicating low predicted near-term exploitation likelihood.

Detection Methods for CVE-2026-64763

Indicators of Compromise

Unexpected termination or repeated crashes of Apple applications after opening files from untrusted sources
Crash reports in ~/Library/Logs/DiagnosticReports/ referencing memory corruption signatures such as EXC_BAD_ACCESS or heap corruption
Suspicious files with unusual structure delivered via email, messaging apps, or web downloads

Detection Strategies

Monitor endpoint telemetry for abnormal child processes spawned by document viewers, media players, or file parsers on Apple devices
Correlate application crash events with subsequent process execution or network connections originating from the same user session
Inspect file-open events involving files from untrusted origins and flag them for behavioral analysis

Monitoring Recommendations

Ingest macOS Unified Logs and application crash reports into a centralized data lake for retrospective hunting
Track OS version distribution across the fleet to identify hosts running unpatched builds below iOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6
Alert on execution of unsigned binaries or scripts following file-open events on Apple endpoints

How to Mitigate CVE-2026-64763

Immediate Actions Required

Update all Apple devices to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6
Prioritize patching for endpoints used to process files from external or untrusted sources
Educate users to avoid opening unexpected file attachments or downloads from untrusted senders

Patch Information

Apple has released fixes across its platforms. Refer to the official advisories for build-specific details: Apple Security Advisory #128066, Apple Security Advisory #128067, Apple Security Advisory #128068, Apple Security Advisory #128069, Apple Security Advisory #128070, Apple Security Advisory #128071, and Apple Security Advisory #128072.

Workarounds

No official workarounds are published by Apple; applying the vendor patch is the only supported remediation
Restrict processing of files from untrusted sources on unpatched devices until updates are deployed
Enforce Mobile Device Management (MDM) policies to require minimum OS versions across managed Apple endpoints

bash

# Verify current macOS version and check for available updates
sw_vers -productVersion
sudo softwareupdate --list
sudo softwareupdate --install --all --restart