CVE-2026-64751
A critical flaw in Apple’s operating systems allows an attacker to use freed memory to crash the system or write to kernel memory. The vulnerability is fixed in the 26.6 releases of iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Users should update to these versions to protect their devices.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apple devices running iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS before version 26.6. Typical users include iPhone, iPad, Mac, Apple TV, Apple Vision, and Apple Watch owners.
Real-world impact
An attacker could cause the device to crash unexpectedly or potentially write to protected kernel memory, which could lead to privilege escalation or further compromise of the device.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the entire system.
What to do about it
- 011. Update your device to iOS 26.6 or later, iPadOS 26.6 or later, macOS Tahoe 26.6 or later, tvOS 26.6 or later, visionOS 26.6 or later, or watchOS 26.6 or later.
- 022. Restart the device to complete the update.
NVD-referenced vendor advisory
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- support.apple.com/en-us/128066release notesvendor advisory
- support.apple.com/en-us/128067release notesvendor advisory
- support.apple.com/en-us/128068release notesvendor advisory
- support.apple.com/en-us/128069release notesvendor advisory
- support.apple.com/en-us/128070release notesvendor advisory