Apple EUVD-2026-49480

We are to produce a JSON object with the required fields, synthesizing all available data.

Input data:

• CVE: CVE-2026-64762
• Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
• CVSS: 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• CWE: CWE-125 (Out-of-bounds Read)
• EPSS: 0.15% (percentile 5%), so low exploitation probability.
• Patch: Available from vendor
• Tags: Apple, Buffer Overflow, Information Disclosure (but CWE is CWE-125, not buffer overflow. Tags may be inaccurate. Description says out-of-bounds read, not buffer overflow. We'll note CWE.)
• SSVC: Exploitation: none, Automatable: yes, Technical Impact: total
• ENISA EUVD: ID EUVD-2026-49480, affected versions: macOS 0 <14.8.8, macOS 0 <26.6, macOS 0 <15.7.8. Note: "macOS 0" probably means all versions before those fixes, including Sonoma 14.x before 14.8.8, sequoia before 15.7.8, Tahoe before 26.6. But product is macOS.
• References: three Apple support articles. Those likely contain patch info.
• CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*

No KEV mention, so not actively exploited. POC status unknown. So exploitation status: "no public exploit identified at time of analysis" unless there is POC flag, but data says Tags: Apple, ... no mention of POC. I'll assume no public exploit.

Now, for each field, construct strings per instructions.

product_name: "macOS" (just 3 words? "macOS" is one word. Could be "Apple macOS", but instructions say product name only, not vendor. So "macOS" is fine.)

summary: Must not copy or paraphrase description. Synthesize. Provide impact, product, and what attacker can do. Start with specific impact verb and product. Options: "Unexpected system termination in macOS through out-of-bounds read allows...". But description says an app may cause unexpected system termination. So local app can crash the syst