CVE-2026-64724 - Vulnerability Details

Description

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker on the local network may be able to cause a denial-of-service.

Published: 2026-07-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The issue is improper memory handling in several Apple operating systems, fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. An attacker on the local network may be able to cause a denial-of-service by triggering improper memory accesses, leading to system crashes and availability disruption. The weakness aligns with a resource exhaustion scenario (CWE‑400).

Affected Systems

Affected Apple products include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. It is inferred that versions before iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 are susceptible. The security update in these releases addresses the defect.

Risk and Exploitability

The EPSS score is less than 1 %, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, signifying no known mass‑targeted attacks. The CVSS score of 5.5 reflects a moderate impact when exploiting the flaw. An attacker must be on the local network and capable of sending crafted traffic to trigger the improper memory handling, which can lead to a denial‑of‑service. Given the low exploitation likelihood, the risk remains moderate but remediation is still advisable.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.10
`0`	affected	< 26.6

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 14.8.8
`0`	affected	< 15.7.8
`0`	affected	< 26.6

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

100%

Version	Status	Scheme	Platform
`[0,26.6)`	affected	generic	—

Apple

Macos

100%

Version	Status	Scheme	Platform
`[0,14.8.8)`	affected	generic	—
`[0,15.7.8)`	affected	generic	—
`[0,26.6)`	affected	generic	—

Apple

Tvos

100%

Version	Status	Scheme	Platform
`[0,26.6)`	affected	generic	—

Apple

Visionos

100%

Version	Status	Scheme	Platform
`[0,26.6)`	affected	generic	—

Apple

Watchos

100%

Version	Status	Scheme	Platform
`[0,26.6)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest security update for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to address the memory handling flaw.
Restrict local network exposure by disabling unused network interfaces or applying firewall rules that limit communication from untrusted devices.
Monitor system logs for abnormal crashes or repeated denial‑of‑service incidents following a local network attack attempt.

Generated by OpenCVE AI on August 18, 2026 at 00:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0018.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/128066
https://support.apple.com/en-us/128067
https://support.apple.com/en-us/128068
https://support.apple.com/en-us/128069
https://support.apple.com/en-us/128070
https://support.apple.com/en-us/128071
https://support.apple.com/en-us/128072
https://support.apple.com/en-us/148287

History

Tue, 18 Aug 2026 01:00:00 +0000

Type	Values Removed	Values Added
Title	Improper Memory Handling Allows Local Denial of Service on Apple Devices

Mon, 17 Aug 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker on the local network may be able to cause a denial-of-service.	The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker on the local network may be able to cause a denial-of-service.
References		https://support.apple.com/en-us/148287

Wed, 05 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title		Improper Memory Handling Allows Local Denial of Service on Apple Devices

Mon, 03 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title	Local Network Denial-of-Service via Improper Memory Handling Across Apple Platforms
Weaknesses	CWE-119 CWE-416

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title		Local Network Denial-of-Service via Improper Memory Handling Across Apple Platforms
Weaknesses		CWE-119 CWE-400 CWE-416
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 28 Jul 2026 03:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker on the local network may be able to cause a denial-of-service.
References		https://support.apple.com/en-us/128066 https://support.apple.com/en-us/128067 https://support.apple.com/en-us/128068 https://support.apple.com/en-us/128069 https://support.apple.com/en-us/128070 https://support.apple.com/en-us/128071 https://support.apple.com/en-us/128072

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Tvos Visionos Watchos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-07-27T20:12:58.667Z

Updated: 2026-08-17T21:30:02.018Z

Reserved: 2026-07-20T18:09:47.192Z

Link: CVE-2026-64724

Vulnrichment

Updated: 2026-07-28T14:33:07.551Z

NVD

Status : Modified

Published: 2026-07-27T21:17:11.350

Modified: 2026-08-17T22:17:18.227

Link: CVE-2026-64724

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-18T00:45:05Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object