CVE-2026-64765: Apple iPadOS RCE Vulnerability

CVE-2026-64765 Overview

CVE-2026-64765 is an integer overflow vulnerability [CWE-190] affecting multiple Apple operating systems. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution on affected devices. Apple addressed the issue with improved input validation across its product lines.

The flaw requires local access and user interaction, such as opening a crafted file. Successful exploitation can compromise confidentiality, integrity, and availability of the affected system. Apple shipped fixes in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

Critical Impact
Attackers can trigger arbitrary code execution by convincing a user to open a maliciously crafted file on an unpatched Apple device.

Affected Products

Apple iOS and iPadOS (prior to 26.6)
Apple macOS Sequoia (prior to 15.7.8), macOS Sonoma (prior to 14.8.8), macOS Tahoe (prior to 26.6)
Apple tvOS, visionOS, and watchOS (prior to 26.6)

Discovery Timeline

2026-07-27 - CVE-2026-64765 published to the National Vulnerability Database (NVD)
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64765

Vulnerability Analysis

CVE-2026-64765 is an integer overflow classified under [CWE-190]. The flaw occurs when file-parsing logic performs arithmetic on attacker-influenced size or length fields without validating that the result stays within representable bounds. When the calculation overflows, downstream memory allocations or copy operations use an incorrect size, resulting in memory corruption.

An attacker leverages this behavior by crafting a file that forces the vulnerable arithmetic path. Opening the file triggers the overflow, which can terminate the affected application or corrupt memory in a way that enables arbitrary code execution in the process context. The attack vector is local and requires user interaction.

Apple's advisory states the issue was addressed with improved input validation, indicating that patched builds now enforce bounds checks on the vulnerable arithmetic before allocating or copying memory.

Root Cause

The root cause is missing or insufficient validation of numeric fields parsed from an untrusted file. Arithmetic on these fields wraps around the integer type's maximum value, producing a smaller-than-expected result. Subsequent code paths trust the wrapped value and operate on undersized buffers, corrupting adjacent memory.

Attack Vector

Exploitation requires the attacker to deliver a crafted file to a local user through email, messaging, a website, or removable media. The user must open or process the file with a vulnerable application. No prior authentication is required, but user interaction is mandatory. Successful exploitation yields code execution at the privilege of the invoking process.

No public proof-of-concept or in-the-wild exploitation has been reported. See the Apple Security Update 128066 for platform-specific details.

Detection Methods for CVE-2026-64765

Indicators of Compromise

Unexpected crashes or termination of media, document, or file-handling applications shortly after opening an attachment or downloaded file.
Crash reports referencing memory corruption, heap corruption, or EXC_BAD_ACCESS inside file-parsing frameworks.
Delivery of unusual file formats via email, messaging apps, or drive-by downloads immediately preceding a crash.

Detection Strategies

Monitor endpoint telemetry for repeated crashes of the same process across multiple users, which can indicate targeted exploitation attempts.
Correlate file open events with subsequent process termination or child-process spawning that deviates from baseline behavior.
Inspect crash diagnostics on macOS and iOS devices for stack traces implicating file-format parsers.

Monitoring Recommendations

Centralize macOS unified logs and crash reports for security review.
Alert on Apple endpoints running builds older than iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.
Track email and web gateway telemetry for delivery of anomalous file types to Apple endpoints.

How to Mitigate CVE-2026-64765

Immediate Actions Required

Apply the Apple security updates on every affected device: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.
Prioritize patching of endpoints that regularly process files from external sources, including executive and helpdesk workstations.
Warn users to avoid opening unexpected files from untrusted senders until updates are installed.

Patch Information

Apple has released fixes across all affected platforms. Refer to the vendor advisories for platform-specific build numbers and download instructions: Apple Security Update 128066, 128067, 128068, 128069, 128070, 128071, and 128072.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation.
Restrict handling of untrusted files on unpatched systems and route suspicious attachments through a sandboxed analysis pipeline.
Enforce mobile device management (MDM) policies that require minimum OS versions before granting access to corporate resources.

bash

# Verify installed macOS build meets the patched version
sw_vers -productVersion

# Trigger available Apple software updates on macOS
sudo softwareupdate -l
sudo softwareupdate -ia --restart