Cyber Resilience

CVE-2026-64749

Memory Safety in Apple Macos 15.0 – 15.7.8

Published
27 July 2026
Modified
29 July 2026
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0012 2th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-64749 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SI-16 (Memory Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, visionOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Kernel memory corruption vulnerability directly enables exploitation for privilege escalation from a user-space app.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Kernel memory corruption from an app directly provides a primitive for privilege escalation via exploitation.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-4010Shared CWE-119
CVE-2026-22167Shared CWE-119
CVE-2025-6693Shared CWE-119
CVE-2025-5869Shared CWE-119
CVE-2023-49618Shared CWE-119
CVE-2026-14607Shared CWE-119
CVE-2026-64697Shared CWE-119
CVE-2026-12216Shared CWE-119
CVE-2026-3145Shared CWE-119
CVE-2025-15411Shared CWE-119

Affected Assets

apple
ipados
≤ 26.6
apple
iphone os
≤ 26.6
apple
macos
15.0 — 15.7.8 · 26.0 — 26.6
apple
visionos
≤ 26.6

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-16 Memory Protection
  • SC-39 Process Isolation
  • SC-3 Security Function Isolation
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V17.3.2

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly implements memory protection safeguards to block unauthorized modification or corruption of kernel memory by user-space apps.

prevent

Enforces separate execution domains so an app cannot affect kernel memory space or cause system termination via memory-handling flaws.

prevent

Isolates security-critical kernel functions from non-privileged user processes, limiting the impact of buffer-boundary violations (CWE-119).

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (bounds checking, safe APIs, reviews) directly prevent this class of flaw.

ID.RA-01 partial match
prevents

Vulnerability scanning and code analysis directly surface buffer-boundary flaws.

ID.RA-08 partial match
prevents

Receiving and triaging vulnerability disclosures commonly includes buffer-related reports.

PR.AT-02 partial match
prevents

Developer training on secure coding reduces introduction of memory-buffer errors.

PR.PS-02 partial match
prevents

Patching replaces vulnerable code containing buffer-boundary defects.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development catches out-of-bounds accesses before release, covering most instances of the weakness.

prevents

Secure development lifecycle mandates memory-safety practices that directly prevent buffer-boundary violations.

prevents

Application security requirements can specify memory-safety rules, but do not prescribe implementation details.

prevents

Secure architecture and engineering principles include memory-safe design patterns that mitigate buffer overflows.

prevents

Secure coding standards explicitly forbid unsafe buffer operations, directly eliminating CWE-119.

References