CVE-2026-64771
published 2026-07-27CVE-2026-64771: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia…
PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.70%
50.5th percentile
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 18.7.10 | 18.7.10 |
| apple | ios_and_ipados | < 26.6 | 26.6 |
| apple | ipados | < 26.6 | 26.6 |
| apple | iphone_os | < 26.6 | 26.6 |
| apple | macos | < 15.7.8 | 15.7.8 |
| apple | macos | < 26.6 | 26.6 |
| apple | macos | >= 15.0 < 15.7.8 | 15.7.8 |
| apple | macos | >= 26.0 < 26.6 | 26.6 |
| apple | tvos | < 26.6 | 26.6 |
| apple | visionos | < 26.6 | 26.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iOS/iPadOS/macOS/tvOS/visionOS prior 26.6/15.7.8 buffer overflow
vuldb·2026-07-28
CVE-2026-64771 Apple iOS/iPadOS/macOS/tvOS/visionOS prior 26.6/15.7.8 buffer overflow
A vulnerability was found in Apple iOS, iPadOS, macOS, tvOS and visionOS. It has been rated as very critical. This issue affects some unknown processing. This manipulation causes buffer overflow.
This vulnerability is handled as CVE-2026-64771. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is advised.
GHSA
A buffer overflow was addressed with improved bounds checking.
ghsa_unreviewed·2026-07-27
CVE-2026-64771 [CRITICAL] CWE-119 A buffer overflow was addressed with improved bounds checking.
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.
No detection rules found.
No public exploits indexed.
Sans Isc
Apple Patches iOS and macOS, (Mon, Aug 17th)
blogs_sans_isc·2026-08-17·CVSS 5.5
CVE-2026-28958 [MEDIUM] Apple Patches iOS and macOS, (Mon, Aug 17th)
Apple Patches iOS and macOS
Published: 2026-08-17. Last Updated: 2026-08-17 20:26:39 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller macOS update that addressed the single screen-sharing vulnerability. This vulnerability did not affect iOS/iPadOS.
None of the vulnerabilities has been exploited so far. There are a few WebKit vulnerabilities, but no standalone Safari patch for older operating systems. 87 of the vulnerabilities affect only iOS 18, making this more of an iOS 18 release than one for the newer operating systems. Only six vulnerabilities affect all three OSs released today. All 6 vulnerabilities affect WebKit.
Apple's
Sans Isc
Apple Patches Everything (July 2026), (Wed, Jul 29th)
blogs_sans_isc·2026-07-29·CVSS 5.5
CVE-2026-28849 [MEDIUM] Apple Patches Everything (July 2026), (Wed, Jul 29th)
Apple Patches Everything (July 2026)
Published: 2026-07-29. Last Updated: 2026-07-29 07:32:37 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
I am a bit late with this summary, but this week Apple released updates to all its operating systems and Safari. The Safari update, as usual, targets macOS prior to macOS 26. macOS updates covered the two older versions (14 and 15), while other operating system patches only covered the current 26 versions.
A total of 187 vulnerabilities are addressed in this update. Many cover multiple operating systems. Apple did not label any of the vulnerabilities as already being exploited.
Three vulnerabilities that caught my interest are CVE-2026-28849, CVE-2026-28900, and CVE-2026-28914. These issues appear to be the vulnerability described in https://m
2026-07-27
Published