CVE-2026-64775: Apple iPadOS DOS Vulnerability

CVE-2026-64775 Overview

CVE-2026-64775 is a memory initialization vulnerability [CWE-665] affecting a wide range of Apple operating systems. According to Apple's advisories, an application may be able to trigger unexpected system termination by leveraging uninitialized memory during runtime operations. The issue was addressed with improved memory handling in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The vulnerability carries a CVSS 3.1 score of 9.8 and impacts confidentiality, integrity, and availability.

Critical Impact
A malicious app can cause unexpected system termination on unpatched Apple devices, disrupting device availability across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS platforms.

Affected Products

Apple iOS and iPadOS prior to 26.6
Apple macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6
Apple tvOS, visionOS, and watchOS prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-64775 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64775

Vulnerability Analysis

The vulnerability stems from improper memory initialization in a component shared across Apple's operating systems. When affected code paths execute, memory regions are read or acted upon before being fully initialized, which leads to inconsistent state. An attacker-controlled application can trigger this condition to force unexpected system termination.

Apple's advisories describe the fix as improved memory handling, indicating the affected routines now explicitly initialize memory before use. The weakness is classified under CWE-665: Improper Initialization. While Apple's advisory language specifies unexpected system termination as the observed impact, uninitialized memory conditions can, depending on layout, expose additional attack surface for information disclosure or memory corruption.

Root Cause

The root cause is uninitialized memory use in a system component reachable from user-space applications. Data structures or buffers are consumed before being populated with expected values, producing undefined behavior that terminates the affected process or the broader system context.

Attack Vector

Apple states that "an app may be able to cause unexpected system termination." Exploitation requires an application to run on the affected device and invoke the vulnerable code path. A malicious app installed through sideloading, enterprise provisioning, or a compromised legitimate app could reach the vulnerable component and induce the crash condition.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2026-64775 at the time of writing. Refer to the Apple Security Advisory #128066 and related advisories for platform-specific technical notes.

Detection Methods for CVE-2026-64775

Indicators of Compromise

Repeated unexpected system reboots, kernel panics, or respringd/watchdog-triggered restarts on Apple devices running unpatched OS versions.
Crash reports referencing uninitialized memory access, page faults, or abnormal termination signatures in /Library/Logs/DiagnosticReports/ on macOS.
Recently installed or sideloaded applications correlating in time with the appearance of system termination events.

Detection Strategies

Inventory Apple endpoints and compare installed OS build numbers against the fixed versions listed in Apple's advisories.
Collect and centrally analyze crash logs and MDM device health telemetry for anomalous termination patterns tied to specific applications.
Review application installation events on managed Apple fleets, prioritizing apps with entitlements to sensitive frameworks.

Monitoring Recommendations

Forward macOS unified log and crash reporter data to a centralized analytics platform to identify clusters of unexpected terminations.
Alert on device availability drops or repeat reboots reported by MDM tooling on iOS, iPadOS, watchOS, tvOS, and visionOS.
Track application execution telemetry on macOS endpoints and correlate new or unsigned binaries with observed crash events.

How to Mitigate CVE-2026-64775

Immediate Actions Required

Deploy the vendor-supplied updates: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.
Enforce patch deployment across managed Apple devices through your MDM solution and monitor compliance dashboards until coverage is complete.
Restrict installation of untrusted or sideloaded applications on managed endpoints, especially for high-risk user populations.

Patch Information

Apple has issued security updates addressing CVE-2026-64775 across its product lines. Refer to the following advisories: Apple Security Advisory #128066, #128067, #128068, #128069, #128070, #128071, and #128072. Each advisory maps to a specific Apple operating system and lists the corresponding fixed build.

Workarounds

No vendor-supplied workaround is available; upgrading to the fixed OS versions is the only supported remediation.
Limit installation privileges and restrict app sources on managed devices until patches are fully deployed.
Enable automatic security updates on Apple devices to reduce exposure windows for similar future issues.

bash

# Verify installed macOS build and compare against fixed versions
sw_vers -productVersion
sw_vers -buildVersion

# Query iOS/iPadOS device OS version via MDM (example using an MDM API)
# Ensure returned OSVersion is >= 26.6 for iOS/iPadOS
#   e.g., curl -H "Authorization: Bearer $TOKEN" \
#            "https://mdm.example.com/api/devices?fields=OSVersion,DeviceName"