CVE-2026-64747
HIGH 7.8 ALL-YEARSA buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to execute arbitrary code with kernel privileges.
Severe if exploited (CVSS 7.8), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 9th percentile
Impact if exploited
7.8CVSS 3.1 · HIGH · ADP
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
2 candidates
- https://github.com/yiyeshi0-hash/ave263-chain
iPad 8 iPadOS 26.3 AVE toolchain research (CVE-2026-64747 class)
PoC-in-GitHub · CVE-2026-64747
PoC-in-GitHub · CVE-2026-64747 · Updated 2026-08-17T14:46:40Z - https://github.com/eddinos2/CVE-2026-64747
AppleAVE2 kernel driver wire-format research and macOS reachability PoC for CVE-2026-64747.
PoC-in-GitHub · CVE-2026-64747
PoC-in-GitHub · CVE-2026-64747 · Updated 2026-10-24T13:33:48Z
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Apple | Ipados | < 26.6 |
| Apple | Iphone Os | < 26.6 |
| Apple | Macos | ≥ 14.0 and < 14.8.8 |
| Apple | Macos | ≥ 15.0 and < 15.7.8 |
| Apple | Macos | ≥ 26.0 and < 26.6 |
| Apple | Tvos | < 26.6 |
| Apple | Visionos | < 26.6 |
| Apple | Watchos | < 26.6 |
All CVSS metrics
- HIGH 7.8 v3.1 · ADP Primary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - HIGH 7.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Advisories
- https://support.apple.com/en-us/128066 CVE record · apple · Updated 2026-08-17T21:30:40.180Z
NVD · CVE-2026-64747 · Updated 2026-08-17T22:17:20.317 - https://support.apple.com/en-us/128067 CVE record · apple · Updated 2026-08-17T21:30:40.180Z
NVD · CVE-2026-64747 · Updated 2026-08-17T22:17:20.317 - https://support.apple.com/en-us/128068 CVE record · apple · Updated 2026-08-17T21:30:40.180Z
NVD · CVE-2026-64747 · Updated 2026-08-17T22:17:20.317 - https://support.apple.com/en-us/128069 CVE record · apple · Updated 2026-08-17T21:30:40.180Z
NVD · CVE-2026-64747 · Updated 2026-08-17T22:17:20.317 - https://support.apple.com/en-us/128070 CVE record · apple · Updated 2026-08-17T21:30:40.180Z
NVD · CVE-2026-64747 · Updated 2026-08-17T22:17:20.317 - https://support.apple.com/en-us/128071 CVE record · apple · Updated 2026-08-17T21:30:40.180Z
NVD · CVE-2026-64747 · Updated 2026-08-17T22:17:20.317 - https://support.apple.com/en-us/128072 CVE record · apple · Updated 2026-08-17T21:30:40.180Z
NVD · CVE-2026-64747 · Updated 2026-08-17T22:17:20.317 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49539 EUVD · EUVD-2026-49539
Technical & other
- https://support.apple.com/en-us/148287CVE record · apple · Updated 2026-08-17T21:30:40.180Z
NVD · CVE-2026-64747 · Updated 2026-08-17T22:17:20.317
Sources: NVD · CVE.org · All sources and attribution · EPSS