This vulnerability (CVE-2026-64763) is an out-of-bounds write in Apple iOS and iPadOS that occurs when processing specially crafted files. The flaw could lead to unexpected app termination or arbitrary code execution. Apple fixed the issue by removing the vulnerable code in iOS 26.6 and iPadOS 26.6, as well as in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The CVSS v3.1 base score is 7.8, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability may result in unexpected termination of applications or arbitrary code execution on affected Apple devices. This can lead to full compromise of the affected application or device, impacting confidentiality, integrity, and availability of the system.

A fix is available and has been released by Apple in iOS 26.6 and iPadOS 26.6, as well as corresponding updates for other Apple operating systems. Users and administrators should apply these official updates promptly to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official patches.