What is the CVSS score of CVE-2026-64703?

CVE-2026-64703 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64703?

Yes, a patch is available for CVE-2026-64703. Update the affected software to the latest version immediately.

macOS CVE-2026-64703

EUVD-2026-49467 CRITICAL

Use After Free (CWE-416)

2026-07-27 apple

GHSA-jf2p-5wq8-g652

Denial Of Service Use After Free Memory Corruption Apple

9.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.5 MEDIUM

Local vector; user interaction required to run malicious app; only availability impact (denial of service) based on Apple description.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:26 vuln.today

CVSS changed

Jul 28, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:12 cve.org

CRITICAL 9.8

DescriptionCVE.org

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service.

AnalysisAI

A use-after-free vulnerability in macOS allows a local application to cause a denial-of-service by crashing the system or a key service. The flaw affects multiple macOS versions prior to the Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 updates. Despite an assigned CVSS score of 9.8 suggesting remote pre-authentication full compromise, the Apple advisory explicitly describes only a local denial-of-service impact, and the EPSS exploitation probability is very low (0.16%). No active exploitation or public proof-of-concept has been reported, and a vendor patch is available.

Technical ContextAI

The vulnerability stems from a use-after-free condition (CWE-416) in macOS memory management, likely in a kernel or system service routine accessible to unprivileged apps. Common Platform Enumeration (CPE) data identifies the affected software as 'cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*', covering all supported macOS branches up to the specified fix versions. Use-after-free occurs when freed memory is accessed again, potentially allowing an attacker to corrupt memory, but the Apple advisory limits the observed consequence to a denial-of-service. The underlying technology involves native macOS frameworks; no external library or protocol is implicated.

RemediationAI

Update macOS to the fixed version for your branch: Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6, available via Software Update or the Apple support portals (https://support.apple.com/en-us/128067, 128071, 128072). No workarounds have been published; the vulnerability can only be fully mitigated by applying the patch. As a temporary control, ensure only trusted apps are installed and enforce application whitelisting, but this does not remove the underlying flaw. Treat the update as a routine OS security fix given the local nature and denial-of-service impact.