This vulnerability (CVE-2026-64768) is an out-of-bounds read issue in Apple iOS and iPadOS that allows a remote attacker to cause unexpected app termination. The root cause is insufficient input validation leading to memory access outside the intended bounds (CWE-125). Apple fixed the issue in iOS 26.6 and iPadOS 26.6, as well as in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. The vulnerability has a CVSS 3.1 base score of 8.1, with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, indicating a network attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

A remote attacker can exploit this vulnerability to cause an unexpected termination of applications on affected Apple operating systems, resulting in denial of service. The confidentiality impact is rated high, indicating potential exposure of sensitive information due to the out-of-bounds read. There is no integrity impact reported. No known exploits are currently active in the wild.

This issue is fixed in iOS 26.6 and iPadOS 26.6, as well as other Apple OS versions listed in the description. Users and administrators should update to these fixed versions to remediate the vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.