CVE-2026-64721 is a vulnerability in Apple iOS and iPadOS where an application may gain unauthorized access to sensitive user data. The root cause was related to insufficient state management within the operating system. Apple fixed this issue in iOS 26.6 and iPadOS 26.6, along with updates to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The CVSS v3.1 base score is 5.5, indicating medium severity, with an attack vector requiring local access, low complexity, no privileges required, and user interaction needed. The impact is confidentiality loss only, with no integrity or availability impact reported.

An app exploiting this vulnerability could access sensitive user data without proper authorization, potentially compromising user privacy. The vulnerability does not affect system integrity or availability. No known exploits have been reported in the wild.

This vulnerability has been fixed by Apple in iOS 26.6 and iPadOS 26.6. Users and administrators should apply these updates to mitigate the risk. Since the vendor advisory indicates the issue is addressed through improved state management and fixed in these versions, updating to the fixed versions is the recommended remediation. No additional mitigation steps are specified.