CVE-2026-64722 is a buffer overflow vulnerability in Apple iOS and iPadOS that occurs during the processing of 3D models. This flaw can result in unintended disclosure of process memory contents. Apple fixed this issue by improving memory handling in iOS 26.6 and iPadOS 26.6, as well as in macOS Sequoia 15.7.8 and macOS Tahoe 26.6. The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input). The CVSS 3.1 base score is 5.5, indicating medium severity, with an attack vector of local, low attack complexity, no privileges required, user interaction required, and high confidentiality impact.

Successful exploitation of this vulnerability can lead to disclosure of sensitive process memory, potentially exposing confidential information. There is no impact on integrity or availability. The attack requires local access and user interaction, limiting the ease of exploitation. No known exploits are reported in the wild at this time.

A fix is available in iOS 26.6 and iPadOS 26.6, which addresses the buffer overflow by improving memory handling. Users and administrators should update affected devices to these versions or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official vendor updates.