Apple macOS CVE-2026-64756

Exploitation requires a malicious or compromised application to be installed and run on the target device, plus user interaction to launch it (CVSS AV:L, UI:R, PR:N - no elevated privileges or special entitlements needed once the app executes). The vulnerable code is present on unpatched iOS/iPadOS before 27 and macOS before 15.8, 26.7, and 27, so devices on those releases are in scope; properly updated systems are not. Limiting factors: the attacker cannot reach the target over the network - a local app must already be present - and the victim must take an action to run it, which Gatekeeper/notarization, MDM app allowlisting, and App Store review restrictions all impede on managed devices. The advisory does not specify which protected data store or permission domain is reachable, so the precise value of the data an attacker can obtain is not confirmed from available data.

The signals here point to a moderate, real but unexceptional risk. CVSS 3.1 is 5.5 with AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - high confidentiality impact, but the attack is local and requires the victim to interact (installing and launching a hostile app), which is why it does not score critical. EPSS is only 0.20% (10th percentile), there is no CISA KEV entry, and no public exploit code has been identified, so this is not an active threat to most fleets. That low EPSS does not mean the flaw is harmless: path-traversal sandbox bypasses on Apple platforms are attractive building blocks for malware that harvests documents, photos, or app data, and a mid-sized IT team such as one managing a municipal fleet in rybnik should treat it as a routine-but-timely update rather than a hair-on-fire emergency. There is no conflicting data between the vector and the description, though the exact protected resource targeted and whether the malicious app needs specific entitlements are not specified in the advisory - those details would refine the practical exploitability. The absence of a POC reference means exploit maturity is unproven; treat severity as patched-version baseline, not imminent compromise.

An attacker convinces a user to install a seemingly benign app (from a third-party store, sideloaded build, or a compromised developer account) and launch it once. The app supplies a crafted path - for example one using traversal sequences or a canonicalization trick - to a file API whose validation does not fully resolve the path, letting it read files outside its container, such as documents, photos, or other apps' exposed data. The harvested data is then exfiltrated over the network; the low complexity of the bug (AC:L, PR:N) means no special entitlements or elevated privileges are needed once the app is running.