CVE-2026-64738
A critical permissions flaw in macOS allows a malicious app to escape its sandbox and gain full control of the system. The issue is fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Users running earlier versions are at risk.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
macOS Sequoia, Sonoma, and Tahoe users running versions older than 15.7.8, 14.8.8, and 26.6 respectively.
Real-world impact
An attacker could use a malicious application to break out of the macOS sandbox, accessing sensitive data, modifying files, and potentially taking full control of the affected device.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely without authentication, requires no user interaction, and grants an attacker complete confidentiality, integrity, and availability compromise.
What to do about it
- 011. Update macOS to at least Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6.
- 022. Restart the computer to complete the update.
NVD-referenced vendor advisory
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 2h agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- support.apple.com/en-us/128067release notesvendor advisory
- support.apple.com/en-us/128071release notesvendor advisory
- support.apple.com/en-us/128072release notesvendor advisory