High CVSS 7.1
CVE-2026-64692
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause a denial-of-service.
What this means
- Exposure
- Exploitable with local access to the machine and without authentication — but only if a user opens booby-trapped content.
- Impact
- An attacker can read sensitive data and take the service offline.
- Weakness
- An out-of-bounds read exposes adjacent memory, often leftover secrets.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.