CVE-2026-64764: Apple iPadOS RCE Vulnerability

CVE-2026-64764 Overview

CVE-2026-64764 is an out-of-bounds write vulnerability [CWE-787] affecting Apple's operating system product line. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution on the target device. Apple addressed the flaw with improved bounds checking across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

The vulnerability requires local access and user interaction, typically through opening a malicious file. Successful exploitation can compromise confidentiality, integrity, and availability of the affected system.

Critical Impact
Attackers who convince a user to process a crafted file can trigger arbitrary code execution within the context of the vulnerable application across Apple's entire OS portfolio.

Affected Products

Apple iOS and iPadOS (prior to 26.6)
Apple macOS Sequoia (prior to 15.7.8), macOS Sonoma (prior to 14.8.8), macOS Tahoe (prior to 26.6)
Apple tvOS, visionOS, and watchOS (prior to 26.6)

Discovery Timeline

2026-07-27 - CVE-2026-64764 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64764

Vulnerability Analysis

CVE-2026-64764 is classified as an out-of-bounds write [CWE-787]. The flaw allows a process parsing a maliciously crafted file to write data beyond the boundaries of an allocated buffer. This condition corrupts adjacent memory structures, which attackers can leverage to hijack control flow.

Exploitation results in unexpected application termination or arbitrary code execution. The vulnerability spans Apple's entire operating system lineup, indicating the affected component is shared framework code common to iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

The attack requires local access with user interaction. An attacker must deliver the crafted file to the victim and induce the victim to open or process it through a vulnerable application.

Root Cause

The root cause is insufficient bounds checking during file parsing. When the vulnerable code processes attacker-controlled input, it fails to validate that write operations remain within allocated buffer boundaries. Apple's fix introduces improved bounds checking to prevent writes past the intended buffer limits.

Attack Vector

An attacker crafts a malicious file targeting the vulnerable parser. The file is delivered through email, messaging, web download, or a shared storage medium. When the victim opens the file with an affected Apple application, the parser triggers the out-of-bounds write. Attackers can chain this primitive with additional techniques to achieve arbitrary code execution in the process context.

Refer to the Apple security advisories for details on affected components and fixes.

Detection Methods for CVE-2026-64764

Indicators of Compromise

Unexpected crashes or termination of Apple system applications when opening files
Crash reports referencing memory corruption, EXC_BAD_ACCESS, or heap/stack corruption signatures
Presence of unusual files delivered from untrusted sources shortly before crash events
Anomalous child process creation from applications that typically do not spawn subprocesses

Detection Strategies

Monitor endpoint telemetry for repeated crashes of the same application, which may indicate exploit attempts
Correlate file open events with subsequent process crashes to identify malicious payload delivery
Inspect diagnostic reports under ~/Library/Logs/DiagnosticReports/ on macOS for out-of-bounds write signatures
Deploy behavioral detection to flag unusual post-exploitation activity such as unexpected network connections or shell spawning

Monitoring Recommendations

Ingest macOS Unified Log and crash telemetry into a centralized analytics platform for retention and search
Track OS version compliance across the fleet to identify unpatched endpoints
Alert on newly executed binaries originating from user Downloads or temporary directories
Review MDM reporting to confirm all Apple devices have received the fixed OS versions

How to Mitigate CVE-2026-64764

Immediate Actions Required

Update all Apple devices to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6
Prioritize patching devices used by high-value targets and those exposed to untrusted file sources
Communicate risk to end users and instruct them to avoid opening unexpected files
Verify patch deployment through mobile device management (MDM) inventory reports

Patch Information

Apple has released fixes across its product line. Detailed patch notes are available in the vendor advisories: Apple Security Update 128066, 128067, 128068, 128069, 128070, 128071, and 128072.

Workarounds

Restrict processing of files from untrusted origins until patches are applied
Enforce MDM policies that block installation of unmanaged applications and require automatic OS updates
Educate users to verify file sources and avoid opening attachments from unknown senders
Segment devices that cannot be immediately updated and limit their exposure to external file sources

bash

# Verify installed macOS version meets the patched baseline
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart