What is the CVSS score of CVE-2026-64744?

CVE-2026-64744 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64744?

Yes, a patch is available for CVE-2026-64744. Update the affected software to the latest version immediately.

macOS CVE-2026-64744

EUVD-2026-49530 MEDIUM

Information Exposure (CWE-200)

2026-07-27 apple

GHSA-g5x3-gh85-p7pf

Information Disclosure Apple

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local attack with low complexity, no privileges required, but user must launch a crafted application; confidentiality impact is high.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:39 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

5.5 (MEDIUM)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

MEDIUM 5.5

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An information leakage was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to disclose kernel memory.

AnalysisAI

A malicious app on macOS can read kernel memory due to insufficient validation. This information disclosure vulnerability is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.16%).

Technical ContextAI

The flaw resides in the macOS kernel memory management subsystem, where an application can trigger the exposure of kernel memory because of missing validation checks. This is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Apple addressed the issue by adding further validation. The affected CPE (cpe:2.3:a:apple:macos) covers all macOS versions prior to the patched releases. The kernel is a core OS component handling system calls and memory mapping; insufficient bounds or access checks in such handling can leak sensitive data to user space.

RemediationAI

Upgrade to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 or later, as detailed in the Apple security advisories. If immediate patching is not possible, limit execution of unverified applications and rely on macOS Gatekeeper and notarization checks to block unknown malicious apps. The primary and only complete remediation is the official update.