This vulnerability (CVE-2026-64768) is an out-of-bounds read issue categorized under CWE-125. It was resolved by Apple through improved input validation in multiple OS versions. The flaw allows a remote attacker to cause an unexpected app termination, impacting availability. The CVSS 3.1 score is 8.1 (high severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. No known exploits are reported in the wild. The affected platforms include iOS, iPadOS, macOS Sequoia, macOS Sonoma, macOS Tahoe, tvOS, and visionOS, with fixes released in the specified versions.

A remote attacker can cause an unexpected application termination (denial of service) by exploiting the out-of-bounds read vulnerability. The confidentiality impact is high, but integrity is not affected. The availability impact is high due to potential app crashes. No known active exploitation has been reported.

This vulnerability has been fixed by Apple in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. Users and administrators should update to these versions or later to remediate the issue. No additional mitigations are indicated by the vendor advisory.