Out-of-bounds write in macOS - CVE-2026-64750
Published: October 27, 2026
Vulnerability identifier: #VU158016
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64750
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or enabling arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in ImageIO in Apple macOS when processing input. A remote attacker can supply specially crafted input to potentially trigger writes outside the intended memory boundaries and corrupt memory.
Affected software
macOS
Apple iOS
iPadOS
Apple iOS
iPadOS
How to mitigate CVE-2026-64750
Install update from vendor's website.
macOS - addressed in versions 26.7.2 25G332, 15.8.2 24H232
Apple iOS - update to 26.7.2
iPadOS - update to 26.7.2
Apple iOS - update to 26.7.2
iPadOS - update to 26.7.2