CVE-2026-64707 describes a permissions issue in Apple iOS and iPadOS where an application may be able to delete files for which it does not have permission. Apple addressed this vulnerability by improving validation mechanisms. The fix is included in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, and visionOS 26.6. The vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The CVSS 3.1 base score is 5.5, indicating medium severity, with an attack vector of local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with local access and the ability to trick a user into interaction could exploit this vulnerability to delete files without having the required permissions, potentially impacting the integrity of the system or user data. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Apple has fixed this issue in iOS 26.6, iPadOS 26.6, and related macOS and visionOS versions. Users and administrators should apply these official updates to remediate the vulnerability. Patch status is not explicitly confirmed beyond the stated fixed versions; therefore, verify with the vendor advisory for the latest remediation guidance.