What is the CVSS score of CVE-2026-64739?

CVE-2026-64739 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-64739?

Within 24 hours, initiate inventory of all Apple devices across the organization and confirm affected versions across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to determine deployment scope. Within 7 days, develop and begin staged deployment of Apple's security updates, prioritizing business-critical systems and mobile devices that handle untrusted or customer-provided content. Complete full remediation across all affected Apple platforms within 30 days, tracking deployment metrics and verifying successful patch installation.

Apple iOS CVE-2026-64739

Q: Which versions of Apple iOS are affected by CVE-2026-64739?

A memory corruption vulnerability (CVE-2026-64739, CVSS 8.8) affects all major Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS), potentially causing application crashes when…. A patch is available.

EUVD-2026-49472 HIGH

Out-of-bounds Write (CWE-787)

2026-07-27 apple

GHSA-37v7-fcj8-25rq

Buffer Overflow Memory Corruption Apple Tvos Visionos Watchos Ios And Ipados

8.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Apple confirms only app termination, so I score A:H with C:N/I:N; remote crafted content with required user interaction gives AV:N/PR:N/UI:R.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:58 vuln.today

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

HIGH 8.8

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker may be able to cause unexpected app termination.

AnalysisAI

Out-of-bounds write in Apple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker to trigger memory corruption leading to unexpected application termination when a victim processes maliciously crafted content. The flaw affects all major Apple platforms below the fixed versions and was reported and patched by Apple. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile).

Technical ContextAI

This is a memory-safety defect classified as CWE-787 (Out-of-bounds Write), a class in which code writes past the bounds of an allocated buffer, corrupting adjacent memory. Apple states it was addressed with improved bounds checking, indicating a missing or incorrect length/offset validation in a component that parses attacker-influenced data. The affected surface spans Apple's shared OS codebase, per the CPE list covering apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos, which strongly suggests the vulnerable code lives in a framework common to all these platforms (e.g., a media, font, or content-parsing library). Tags corroborate the root cause: Memory Corruption and Buffer Overflow.

RemediationAI

Apply the Apple updates that contain the fix: Vendor-released patch - iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Consult the matching Apple advisory for your platform (https://support.apple.com/en-us/128066-128072) to confirm the exact build for your device before deployment. No vendor workaround is documented; because exploitation requires the user to open or process attacker-supplied content, an effective compensating control until patching is to avoid opening untrusted files, messages, and web content and to restrict delivery channels for such content - with the trade-off that this is user-behavior-dependent and cannot fully substitute for the update.