CVE-2026-64746 is an authorization vulnerability in Apple iOS and iPadOS where an app may add contacts without obtaining user consent. The issue stems from insufficient validation of authorization checks. Apple fixed this vulnerability in version 26.6 of iOS, iPadOS, macOS Tahoe, visionOS, and watchOS by improving validation mechanisms to prevent unauthorized contact additions. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability could allow a malicious app to add contacts to the user's device without their authorization, potentially leading to privacy violations and unauthorized data manipulation. The high CVSS score indicates that the vulnerability can be exploited remotely without user interaction and can severely compromise the affected system's confidentiality, integrity, and availability.

This vulnerability is fixed in iOS 26.6 and iPadOS 26.6, as well as macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6. Users and administrators should update affected Apple operating systems to these versions or later to remediate the issue. Patch status is confirmed by the vendor advisory indicating an official fix is available.