CVE-2026-64716 is a memory corruption vulnerability in Apple iOS and iPadOS caused by processing a maliciously crafted image. The underlying issue is improper memory handling (CWE-119). Apple addressed this vulnerability with improved memory management in iOS 26.6 and iPadOS 26.6, as well as in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The CVSS v3.1 base score is 7.8, indicating high severity, with an attack vector of local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits in the wild have been reported.

Successful exploitation of this vulnerability may lead to corruption of process memory, potentially allowing an attacker to execute arbitrary code, cause denial of service, or leak sensitive information. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. Exploitation requires local access and user interaction.

Apple has released official fixes for this vulnerability in iOS 26.6 and iPadOS 26.6, as well as in other Apple operating systems. Users and administrators should update affected devices to these versions or later to remediate the issue. Since the vulnerability requires processing a maliciously crafted image, avoiding untrusted images may reduce risk until patches are applied.