CVE-2026-64741 is a vulnerability in Apple iOS and iPadOS where an app may be able to read a persistent device identifier due to insufficient permissions restrictions. Apple addressed this issue by implementing additional restrictions on access to the identifier. The fix is included in iOS 26.6, iPadOS 26.6, and corresponding versions of other Apple operating systems. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS vector indicates the attack requires local access with low complexity and no privileges but requires user interaction, impacting confidentiality but not integrity or availability.

An attacker with local access and user interaction could exploit this vulnerability to obtain a persistent device identifier, potentially compromising user privacy by enabling device tracking or fingerprinting. There is no impact on integrity or availability. No known exploits are reported in the wild.

This vulnerability is fixed in iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Users and administrators should update affected Apple devices to these versions or later to remediate the issue. No additional mitigations are indicated by the vendor.