What is the CVSS score of CVE-2026-64716?

CVE-2026-64716 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64716?

Yes, a patch is available for CVE-2026-64716. Update the affected software to the latest version immediately.

Apple iOS CVE-2026-64716

EUVD-2026-49441 HIGH

Buffer Overflow (CWE-119)

2026-07-27 apple

GHSA-6wwc-jxw9-5qhh

Buffer Overflow Apple Ios And Ipados Tvos Visionos Watchos

7.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Malicious image must be opened by the victim, so AV:L and UI:R with PR:N; memory corruption yields high C/I/A and unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:50 vuln.today

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:14 cve.org

HIGH 7.8

CVE Published

Jul 27, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted image may corrupt process memory.

AnalysisAI

Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.

Technical ContextAI

The flaw is a CWE-119 improper restriction of operations within memory bounds (buffer overflow), triggered during image decoding/parsing. The affected component is Apple's shared image-handling code (broadly the ImageIO/CoreGraphics family that underpins all listed OSes), which is why a single CVE spans cpe:2.3:a:apple:ios_and_ipados, :macos, :tvos, :visionos, and :watchos. Apple's advisory language ('addressed with improved memory handling') indicates the root cause was insufficient bounds validation when handling attacker-controlled image structure, allowing out-of-bounds read/write that corrupts adjacent process memory - a classic precursor to memory-safety exploitation.

RemediationAI

Vendor-released patch: update to iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6 as applicable to each device, referencing the platform-specific advisories at https://support.apple.com/en-us/128066 through https://support.apple.com/en-us/128072. There is no vendor-documented configuration workaround since the flaw is in core image handling; as an interim compensating control, avoid opening images from untrusted sources and restrict automatic image rendering/previews where feasible (e.g., disabling automatic media loading in messaging/mail clients), accepting the usability trade-off of manual media handling. Deploy the updates through MDM for managed fleets to close the window quickly given the total technical impact.