What is the CVSS score of CVE-2026-64698?

CVE-2026-64698 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64698?

Yes, a patch is available for CVE-2026-64698. Update the affected software to the latest version immediately.

macOS CVE-2026-64698

EUVD-2026-49507 CRITICAL

Buffer Overflow (CWE-119)

2026-07-27 apple

GHSA-fp66-6ffv-26gm

Buffer Overflow Apple

9.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Local attack, no privileges, user must launch app; impacts confidentiality (read kernel memory) and availability (crash) but not integrity.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 17:23 vuln.today

CVSS changed

Jul 28, 2026 - 17:22 NVD

9.8 (CRITICAL)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:13 cve.org

CRITICAL 9.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or read kernel memory.

AnalysisAI

A memory handling vulnerability in macOS kernel allows a local malicious application to read kernel memory or trigger an unexpected system termination, without requiring elevated privileges. Fixed versions are macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No public exploit code is known, and the extremely low EPSS likelihood (0.16%) indicates no active exploitation attempts.

Technical ContextAI

The root cause is an improper restriction of operations within the bounds of a memory buffer (CWE-119) in the macOS kernel. The CPE data (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) confirms the vulnerability affects the core macOS operating system. The kernel fails to properly handle memory operations, allowing a user-space application to cause out-of-bounds reads or corruption, leading to information disclosure (kernel memory leak) or denial-of-service via kernel panic.

RemediationAI

Update to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6, which include the patched memory handling. No workaround is provided by Apple; if patching is delayed, limit installation of untrusted applications and use sandboxing profiles to restrict app capabilities, though this is a mitigation only and may not completely prevent exploitation.