Description
The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination.
Published: 2026-07-27
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Application Crash (Denial of Service)
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises from insufficient bounds checking when parsing a file on Apple operating systems. The issue has been addressed with improved bounds checks and is fixed in iOS 26.6, iPadOS 26.6, iOS 26.7, iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. A maliciously crafted file may lead to unexpected application termination, causing a denial of service.

Affected Systems

Apple iOS, iPadOS, macOS (Sequoia 15.8, macOS Tahoe 26.6), tvOS, visionOS, and watchOS. Versions older than the corresponding fixes (iOS 26.6/26.7, iPadOS 26.6/26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6) are susceptible; all listed platforms include the corrective changes in the specified versions or later.

Risk and Exploitability

The CVSS score is 7.8, indicating high severity. The EPSS score is below 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, signifying no publicly known exploitation. An attacker would need to supply a specifically crafted file to a target device; the impact is limited to application termination without privilege escalation or data breach.

Generated by OpenCVE AI on October 20, 2026 at 13:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the operating system to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6, or later versions that include the bounds‑check fix.
  • Enforce bounds‑checking when parsing files to mitigate the CWE‑119 memory corruption vulnerability, rejecting any inputs that could trigger an out‑of‑bounds read.
  • Monitor application stability and crash logs after applying the update, ensuring that the bounds‑check improvement has resolved the issue in the intended environment.

Generated by OpenCVE AI on October 20, 2026 at 13:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Title Bounds Check Vulnerability Causing Application Crash on Apple Operating Systems

Tue, 20 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination. The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination.
References

Thu, 13 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Title Bounds Check Vulnerability Causing Application Crash on Apple Operating Systems

Wed, 12 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Title Apple OS Bounds Check Vulnerability Causing Application Crash
Weaknesses CWE-20

Mon, 03 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Title Apple OS Bounds Check Vulnerability Causing Application Crash
Weaknesses CWE-119
CWE-20

Sun, 02 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
Title Bounds Check Error Leading to App Crashes on Apple Devices
Weaknesses CWE-787
CWE-788

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Bounds Check Error Leading to App Crashes on Apple Devices
Weaknesses CWE-787
CWE-788

Tue, 28 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos
Apple watchos

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-10-26T20:35:10.523Z

Reserved: 2026-07-20T18:10:30.633Z

Link: CVE-2026-64758

cve-icon Vulnrichment

Updated: 2026-07-28T14:39:56.311Z

cve-icon NVD

Status : Modified

Published: 2026-07-27T21:17:14.220

Modified: 2026-10-20T01:17:14.217

Link: CVE-2026-64758

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T13:45:13Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer