What is the CVSS score of CVE-2026-64696?

CVE-2026-64696 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apple are affected by CVE-2026-64696?

Apple macOS is affected by a critical kernel memory corruption vulnerability (CVE-2026-64696) that allows remote attackers to crash systems or execute arbitrary code with highest privileges.. A patch is available.

How to fix or mitigate CVE-2026-64696?

Within 24 hours, inventory all macOS devices running Sequoia, Sonoma, or Tahoe and confirm versions below 15.7.8, 14.8.8, or 26.6 respectively; begin emergency patching for high-risk systems. By 7 days, deploy patches via MDM to all remaining affected devices and validate no new instances remain. Within 30 days, enforce automated patch management for macOS updates and audit compliance to ensure future critical vulnerabilities are addressed promptly.

Apple CVE-2026-64696

EUVD-2026-49543 CRITICAL

Buffer Overflow (CWE-119)

2026-07-27 apple

GHSA-pf2f-x256-hqh2

Buffer Overflow Apple

9.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (apple) · only source for this CVE.

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:27 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

9.8 (CRITICAL)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:13 cve.org

CRITICAL 9.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

AnalysisAI

Kernel memory corruption vulnerability in Apple macOS allows a remote unauthenticated attacker to cause unexpected system termination or potentially execute arbitrary code with kernel privileges. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Although EPSS indicates low exploitation likelihood and no active exploitation or public exploit is reported, the critical CVSS score and network attack vector make patching a priority.