EUVD-2026-49472
GHSA-37v7-fcj8-25rq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious content
-
DeliveryDeliver to victim (message/web/file)
-
ExploitVictim opens content
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactCorrupt memory / crash app
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process attacker-supplied content - the CVSS vector specifies UI:R (user interaction required), so the target must open or render the malicious data in a vulnerable Apple app/framework; it is not a zero-click, fully-unauthenticated remote takeover of default configurations. No authentication is needed on the attacker side (PR:N), and the device must be running an unpatched OS version (below the fixed builds listed above). The primary limiting factors are the required user interaction and the fact that the confirmed effect per Apple is app termination rather than persistent compromise. |
| Impact | Signals are mixed and should be reconciled before prioritization. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H = 8.8) implies full confidentiality/integrity/availability compromise, yet Apple's own description limits the observed impact to 'unexpected app termination' (a denial-of-service outcome). This is a material conflict - the CVSS confidentiality/integrity scoring appears more severe than the vendor-stated effect, so the 8.8 likely reflects worst-case OOB-write potential rather than confirmed code execution; verify with Apple before treating this as an RCE. Real-world urgency is low-to-moderate: EPSS is 0.17%, CISA SSVC records Exploitation=none and Automatable=no (so no automated mass exploitation), though Technical Impact=total. It is not in CISA KEV and no POC is reported. Exploitation requires user interaction (UI:R). Net: patch on a normal cadence rather than emergency, but note the OOB-write primitive could be more dangerous than 'app termination' suggests if it proves controllable. |
| Exploit ScenarioDerived | An attacker crafts a malicious file or piece of content and delivers it to a victim (via message, email, web page, or app), and when the victim opens or the target app processes it, the out-of-bounds write corrupts memory and crashes the application. No public exploit is identified at time of analysis, so this remains a theoretical/vendor-reported scenario; the practical outcome demonstrated so far is a denial of service (app termination), not confirmed code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Out-of-bounds write in Apple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker to trigger memory corruption leading to unexpected application termination when a victim processes maliciously crafted content. The flaw affects all major Apple platforms below the fixed versions and was reported and patched by Apple. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile).
RemediationAI
Apply the Apple updates that contain the fix: Vendor-released patch - iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Consult the matching Apple advisory for your platform (https://support.apple.com/en-us/128066-128072) to confirm the exact build for your device before deployment. No vendor workaround is documented; because exploitation requires the user to open or process attacker-supplied content, an effective compensating control until patching is to avoid opening untrusted files, messages, and web content and to restrict delivery channels for such content - with the trade-off that this is user-behavior-dependent and cannot fully substitute for the update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a memory-safety defect classified as CWE-787 (Out-of-bounds Write), a class in which code writes past the bounds of an allocated buffer, corrupting adjacent memory. Apple states it was addressed with improved bounds checking, indicating a missing or incorrect length/offset validation in a component that parses attacker-influenced data. The affected surface spans Apple's shared OS codebase, per the CPE list covering apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos, which strongly suggests the vulnerable code lives in a framework common to all these platforms (e.g., a media, font, or content-parsing library). Tags corroborate the root cause: Memory Corruption and Buffer Overflow.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Apple confirms only app termination, so I score A:H with C:N/I:N; remote crafted content with required user interaction gives AV:N/PR:N/UI:R.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker may be able to cause unexpected app termination.
Executive ViewAI
A memory corruption vulnerability (CVE-2026-64739, CVSS 8.8) affects all major Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS), potentially causing application crashes when processing malicious content. While exploitation probability remains low (0.2% EPSS), the vulnerability's broad platform footprint requires immediate patching across the entire Apple device fleet. Timely remediation eliminates a known attack vector that could disrupt business operations through widespread application failures.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB