macOS CVE-2026-64705

Exploitation requires local code execution on the target macOS system as a low-privileged (standard) user; this is confirmed by CVSS AV:L/PR:L. The attacker must be able to launch an application on the affected host. No network access is required, and no authentication beyond a standard macOS user session is needed to trigger the flaw. Exploitation is NOT automatable (SSVC: Automatable: no), meaning it cannot be scripted across targets at scale without local access. Limiting factors: the attacker must already have local execution capability; macOS Gatekeeper and notarization requirements raise the barrier for delivering the malicious app to a default system; the vulnerability does not grant immediate code execution in the kernel - its utility depends on how precisely the overflow can be controlled.

The NVD CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) captures only the availability dimension, but the description explicitly states an app 'may be able to write kernel memory,' which implies an integrity impact not reflected in the official vector - this is a notable discrepancy worth flagging to defenders. EPSS at 0.11% (1st percentile) and SSVC exploitation status of 'none' both indicate extremely low real-world exploitation probability at this time. The attack is not automatable per SSVC, and technical impact is rated only partial. The local attack vector (AV:L) significantly constrains the exposure surface: an attacker must already have code execution on the target machine as a low-privileged user. Despite the moderate CVSS score, the kernel memory write primitive is a meaningful capability that could be chained with other techniques for privilege escalation. Priority should remain low for most organizations unless endpoints are shared or high-value, but the kernel write aspect warrants faster patching than a pure availability bug of equivalent score.

An attacker who has delivered a malicious application to a target macOS system - via phishing, trojanized installer, or supply chain compromise - runs the app under a standard (low-privileged) user account. The app triggers the bounds-unchecked buffer operation, either crashing the system or corrupting kernel memory structures in a controlled manner. If the overflow is sufficiently controlled, the attacker could use the kernel write primitive as a stepping stone toward local privilege escalation to root.