CVE-2026-64766
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
An integer overflow was addressed with improved input validation. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code on the device, potentially leading to full system compromise.
Recommendation
Update iOS, iPadOS, macOS Sequoia, macOS Sonoma, macOS Tahoe, tvOS, visionOS, and watchOS to the versions mentioned in the description.
Other vulnerabilities in Apple iOS
See all- CVE-2015-5882High
The processor_set_tasks API implementation in Apple iOS before version 9 allows local users to bypass an entitlement protection mechanism and gain access to the task ports of arbitrary processes by leveraging root privileges.
- CVE-2014-4451High
Apple iOS before 8.1.1 does not properly enforce the failed-passcode limit, making it easier for physically proximate attackers to bypass the lock-screen protection mechanism via a series of guesses.
- CVE-2013-5133High
Backup in Apple iOS before 7.1 does not properly restrict symlinks, allowing remote attackers to overwrite files during a restore operation via crafted backup data.
- CVE-2026-43814Critical
Memory management was improved to fix a use-after-free issue. An app may be able to cause unexpected system termination.
- CVE-2026-64760Medium
An information leakage was fixed with additional validation. An app may be able to leak sensitive kernel state.
- CVE-2026-64765High
An integer overflow was addressed with improved input validation. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
- CVE-2026-64747High
A buffer overflow was addressed with improved size validation. An app may be able to execute arbitrary code with kernel privileges.
- CVE-2026-43817Medium
Bounds checking was improved to fix an out-of-bounds read. An app may be able to cause unexpected system termination.
- CVE-2026-43816Medium
Bounds checking was improved to fix an out-of-bounds write. An app may be able to cause unexpected system termination.
- CVE-2026-43813High
Input sanitization was improved to fix a validation issue. A maliciously crafted app may be able to bypass code signing enforcement.
Original NVD description (English source)
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.