CVE-2026-64734 is a vulnerability in Apple iOS and iPadOS where processing a maliciously crafted contact may lead to leakage of sensitive data. The issue is categorized under CWE-200 (Exposure of Sensitive Information). Apple fixed this vulnerability by implementing improved validation checks in iOS 26.6, iPadOS 26.6, and other related OS versions. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality impact without integrity or availability impact.

An attacker who can convince a user to process a maliciously crafted contact on a vulnerable device may cause sensitive data to be leaked. The confidentiality of information is impacted, but integrity and availability are not affected. Exploitation requires local access and user interaction, limiting the attack surface. No known exploits are currently reported in the wild.

This vulnerability is fixed in iOS 26.6 and iPadOS 26.6, as well as macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6. Users and administrators should apply these official updates to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigations are indicated.